Reference
A practitioner-level breakdown of common attack vectors and the defensive controls that mitigate each one. Understanding the offence is prerequisite to effective defence.
Attack
Attacker inserts malicious SQL into an input field. The database executes it, allowing authentication bypass, full data extraction, or even OS command execution via stored procedures.
Defense
Parameterised queries / prepared statements. ORM query builders. Input validation and WAF rules. Least-privilege database accounts.
Attack
Malicious JavaScript is injected into a page and executed in other users' browsers. Used for session token theft, keylogging, defacement, and drive-by download distribution.
Defense
Context-aware output encoding. Content Security Policy (CSP) headers. HttpOnly cookies. DOM-based XSS sinks audited at code review.
Attack
Attacker supplies a crafted URL that tricks the server into making requests to internal resources — cloud metadata APIs (169.254.169.254), internal admin panels, or other backend services.
Defense
Allowlist-based URL validation. Block requests to RFC-1918 and link-local ranges. Use IMDSv2 with token on AWS. Strip or block Location redirect headers from internal fetches.
Attack
Application fails to enforce permissions on actions or resources. IDOR (insecure direct object reference) allows accessing other users' data by manipulating an ID in the URL or request body.
Defense
Server-side authorisation checks on every request. Indirect references (UUIDs or opaque tokens) instead of sequential IDs. Regular access control audits.
Attack
Attacker positions themselves between a client and server — via ARP spoofing, rogue Wi-Fi, or DNS poisoning — to intercept, read, or modify traffic in real time.
Defense
TLS everywhere with HSTS and certificate pinning. Network-level detection of ARP anomalies. 802.1X port authentication on wired networks. VPN on untrusted networks.
Attack
Attacker injects forged DNS responses into a resolver's cache, redirecting a domain to a malicious IP before the legitimate TTL expires.
Defense
DNSSEC validation. DNS-over-HTTPS/TLS for stub resolvers. Source port randomisation (RFC 5452). Monitor for BGP/DNS anomalies.
Attack
Systematic probing of open ports and service banners to map the target's exposed attack surface — which services are running, which versions, which CVEs apply.
Defense
Firewall default-deny egress and ingress. Remove or falsify version banners. Network intrusion detection. Regular external scanning of your own assets.
Attack
Convincing email, SMS (smishing), or voice call (vishing) that tricks a target into providing credentials, installing malware, or approving a fraudulent transaction.
Defense
DMARC/DKIM/SPF email authentication. Security awareness training. Phishing-resistant MFA (FIDO2). Sandbox email attachment analysis.
Attack
Attacker fabricates a believable scenario — IT support, auditor, new employee — to extract information or gain physical access without triggering suspicion.
Defense
Identity verification procedures before sharing information. Callback verification for sensitive requests. Employee training on multi-step verification.
Attack
Writing more data into a buffer than it can hold overwrites adjacent memory — including the saved return address. Classic technique for redirecting execution to attacker-controlled shellcode.
Defense
Stack canaries (GCC -fstack-protector). ASLR (address space layout randomisation). NX/DEP (non-executable stack). Use of memory-safe languages (Rust, Go) where possible.
Attack
After gaining low-privileged access, attackers exploit misconfigurations (SUID binaries, weak sudo rules, writable cron jobs) or kernel vulnerabilities to gain root or SYSTEM.
Defense
Principle of least privilege. Regular patching. Audit SUID/SGID binaries. Restrict sudo. Monitor for unexpected privilege changes with EDR tooling.
Attack
Using built-in OS tools (PowerShell, WMI, certutil, curl, cron) to carry out malicious actions, blending in with normal system behaviour to evade signature-based detection.
Defense
Behavioural detection / EDR (not just signatures). Script-block logging for PowerShell. Constrained Language Mode. Application allowlisting.