Chapter 3: Application And Network Attacks

Front 1

add-ons:

Back 1

Programs that provide additional functionality to Web Browsers

Front 2

Address Resolution Protocol:

Back 2

Part of the TCP/IP protocol for determining the MAC address based on the IP address

Front 3

ARP poisoning:

Back 3

An attack that corrupts the ARP cache

Front 4

attachments:

Back 4

Files that are couples to e-mail messages.

Front 5

buffer overflow:

Back 5

An attack that occurs when a process attempts to store data in RAM beyond the boundaries of a fixed-length storage buffer.

Front 6

client-side attack:

Back 6

An attack that targets vulnerabilities in client applications that interact with a compromised server or processes malicious data

Front 7

cookie:

Back 7

A file on a local computer in which a server stores user-specific information

Front 8

command injection:

Back 8

Injecting and executing commands to execute on a server

Front 9

cross-site scripting(XSS):

Back 9

An attack that injects scripts into a web application server to direct attacks at clients.

Front 10

denial of service(DoS):

Back 10

An attack that attempts to prevent a system from performing its normal functions

Front 11

directory traversal:

Back 11

An attack that takes advantage of a vulnerability in the Web application program of the Web server software so that a user can move from the root directory to other restricted directories.

Front 12

distributed denial of service(DDoS):

Back 12

an attack that uses multiple zombie computers (even hundreds or thousands) in a botnet to flood a device with request.

Front 13

DNS poisoning:

Back 13

An attack that substitutes DNS addresses so that the computer is automatically redirected to another device.

Front 14

first-part cookie:

Back 14

A cookie that is created from the web site that currently is being viewed

Front 15

flash cookie:

Back 15

A cookies named after the Adobe Flash player. Also known as local shared objects(LSOs).

Front 16

host table:

Back 16

A list of the mappings of names to computer number

Front 17

HTTP header:

Back 17

Part of HTTP that is composed of fields that contain the different characteristics of the data that is being transmitted

Front 18

HTTP header manipulation:

Back 18

Modifying HTTP headers to create an attack

Front 19

man-in-the-middle:

Back 19

An attack that intercepts legitimate communication and forges a fictitious response to the sender

Front 20

persistant cookie(tracking cookie)

Back 20

A cookie that is recorded on the hard drive of the computer and does not expire when the browser does.

Front 21

ping:

Back 21

A utility that sends a ICMP echo request message to a host

Front 22

ping flood:

Back 22

An attack that uses the Internet Control Message Protocol (ICMP) to flood a victim with packets.

Front 23

privilege escalation:

Back 23

An attack that exploits a vulnerability in software to gain access to resources that the user would normally be restricted from obtaining.

Front 24

replay:

Back 24

An attack that makesa copy of the transmission before sending it to the recipient

Front 25

secure cookie:

Back 25

a cookie that is stored in Random access memory, instead of on the hard drive, and only last for the duration of visiting a web site.

Front 26

session hijacking

Back 26

an attack in which an attacker attempts to impersonate the user by using his session token

Front 27

session token:

Back 27

A form of verification used when accessing a secure web application.

Front 28

smuf atttack:

Back 28

An attack that broadcast a ping request

Front 29

smuf attack:

Back 29

An attack that broadcast a ping request to all computers on the network yet changes the address from which the request came to that of the target.

Front 30

spoofing:

Back 30

Impersonating another computer or device

Front 31

SQL injection:

Back 31

An attack that targets SQL servers by injecting commands to be manipulated by the database

Front 32

SYN flood attack:

Back 32

An attack that takes advantage of the procedures for initiating a TCP session.

Front 33

third-party cookies:

Back 33

A cookie that was created by a third party that is different from the primary web.

Front 34

transitive access:

Back 34

An attack involving using a third party to gain access rights.

Front 35

XML (Extensible Markup Language)

Back 35

A markup language that is designed to carry data instead of indicating how to display it.

Front 36

XML injection

Back 36

An attack that injects XLM tags and data into a database.

Front 37

zero day attacks

Back 37

Attacks that exploit previously unknown vulnerabilities, so victims have no time(zero days) to prepare or defend against the attacks.