Security Operations · Topic 4 of 7
Attack Types and Mitigations
Recognize injection, XSS, CSRF, SSRF, API abuse, memory flaws, privilege escalation, session attacks and malware, and choose mitigations that fit each.
- 6 min
- Parameterized queries stop SQL injection, and output encoding stops XSS.
- Anti forgery tokens and same site cookies counter CSRF.
- SSRF is stopped by destination allow lists and network controls.
What it is
Analysts must recognize an attack from its symptoms and recommend a control that addresses the cause. The exam gives a log line, a description or a behavior, and asks what attack it is and what fix is best.
Think in pairs: the weakness that makes the attack possible, and the control that removes or limits it. This page concentrates on recognition and mitigation, not on how to perform attacks.
How it works
Web and application attacks
| Attack | What it is | Best mitigation |
|---|---|---|
| Injection (Structured Query Language or SQL, command, and others) | Untrusted input is run as part of a command or query | Parameterized queries, input validation, least privilege |
| Cross site scripting (XSS) | Attacker script runs in another user's browser | Output encoding, input validation, content security policy |
| Cross site request forgery (CSRF) | A logged in user's browser is tricked into sending an unwanted request | Anti forgery tokens, same site cookie settings |
| Server side request forgery (SSRF) | The server is tricked into making requests to internal or cloud resources | Allow lists for destinations, network segmentation, metadata protections |
| Directory traversal | Path input used to read files outside the intended folder | Canonicalize and validate paths, restrict file permissions |
| Insecure deserialization | Untrusted serialized data triggers unintended code | Avoid untrusted deserialization, integrity checks |
| Broken access control | Users reach data or functions they should not | Server side authorization checks on every request |
| Session hijacking or fixation | Attacker steals or sets a session identifier | Secure, random session identifiers, regenerate after login, protect cookies |
A web application firewall (WAF) filters many of these at the edge, but it is a compensating layer. Fixing the code is the real cure.
Application programming interface attacks
Application programming interfaces (APIs) are targets because they expose data and logic directly. Common weaknesses include broken object level authorization, where changing an identifier returns another user's record, excessive data exposure, missing rate limits and weak authentication. Mitigate with per request authorization, schema validation, rate limiting, strong token handling and an API gateway with monitoring.
Memory and host attacks
Buffer overflows and related memory flaws let an attacker overwrite memory and take control of execution. Mitigations include memory safe languages, bounds checking, address space layout randomization (ASLR), data execution prevention (DEP) and patching.
A race condition occurs when the result depends on timing, such as checking a permission and then using a resource while it changes. Use locking and atomic operations to prevent it.
Privilege escalation turns limited access into administrative control, through a vulnerable service, a misconfiguration or stolen credentials. Least privilege, patching, removing risky setuid or service permissions and credential protection reduce it.
Network and identity attacks
| Attack | Key sign | Control |
|---|---|---|
| On path (man in the middle) | Unexpected certificate warnings, changes to Address Resolution Protocol (ARP) or Domain Name System (DNS) answers | Encryption with validated certificates, dynamic ARP inspection, DNS Security Extensions (DNSSEC) |
| Denial of service and its distributed form | Traffic or request floods, resource exhaustion | Rate limiting, scrubbing services, redundancy |
| Credential stuffing and password spraying | Many failures across accounts | Multi factor authentication (MFA), lockout and throttling, breached password checks |
| Phishing and business email compromise | Look alike senders, urgent payment requests | Email authentication, training, out of band verification |
| Replay | Captured messages resent | Nonces, timestamps, session binding |
Malware and post compromise
Ransomware encrypts data for payment, often after stealing it first. A rootkit hides at a deep level of the operating system.
Fileless malware runs in memory using built in tools, so file scanning misses it. A web shell gives remote command access through a compromised web server. A command and control channel lets the attacker direct the malware, often by regular beacons.
Controls include endpoint detection and response (EDR), application allow listing, network segmentation, immutable backups and egress filtering. Detect by watching for unusual processes, persistence entries, new accounts and outbound connections.
Choosing between code fix and compensating control
The cause fix, such as secure coding, stops the problem permanently. A compensating control, such as a WAF rule or virtual patch, buys time. The best answer in a scenario depends on whether the system can be changed quickly.
More weaknesses and design level mitigations
| Item | What it is | Fix |
|---|---|---|
| Deprecated functions | Old functions kept for compatibility but now unsafe, such as strcpy and gets in C, or obsolete algorithms and protocol versions such as MD5 and SSLv3 | Replace with bounds checked or current equivalents, and use static analysis to find calls |
| Confused deputy | A privileged service is tricked by a less privileged party into misusing its own authority, as in server side request forgery or cross account role misuse | Check the caller's rights on each request, scope delegated permissions, and require an external identifier for cross account roles |
| Implants | Malicious hardware, firmware or components planted in a device, or a backdoor left after compromise, often surviving reinstallation | Trusted suppliers, tamper evidence, signed firmware, attestation and integrity checks against known good images |
Security design patterns are proven structures that avoid whole classes of flaws. Examples include secure by default (the safest setting needs no action), complete mediation (every access is checked, such as an API checking permission on every request, not only at login), economy of mechanism (keep designs simple) and least privilege.
What to remember for the exam
- Parameterized queries stop SQL injection, and output encoding stops XSS.
- Anti forgery tokens and same site cookies counter CSRF.
- SSRF is stopped by destination allow lists and network controls.
- Broken object level authorization is a leading API flaw, fixed by per request checks.
- ASLR and DEP make memory exploitation harder, and memory safe languages remove classes of flaws.
- Race conditions need locking or atomic operations.
- A WAF is a compensating control, and code fixes are the permanent answer.
- Fileless malware requires behavior based detection such as EDR.
Match the fix to the cause. Input problems need validation and encoding, authorization problems need server side checks, and credential problems need MFA and throttling.
Common mistakes
Choosing a firewall for an application flaw. A network firewall cannot see inside normal web requests, so use secure code and a WAF.
Confusing XSS and CSRF. XSS runs attacker script in the victim's browser, while CSRF forges a request using the victim's existing session.
Relying on client side checks. The attacker controls the client, so validation must also be on the server.
Assuming antivirus covers fileless threats. It watches files, not memory only activity.
Blocking by a single indicator, such as one address, does not stop attacks that change infrastructure, so also address the technique.
Check yourself
Work through these three questions.
What is the best fix for SQL injection?
Parameterized queries with input validation, so data cannot be run as commands.
How does CSRF differ from XSS?
CSRF tricks a user's browser into sending a request using their session, while XSS runs attacker script inside a trusted page.
Why does fileless malware evade file scanning?
It runs in memory using built in tools and leaves few or no files to scan.
Topic 4 of 7 in Security Operations
Test yourself on Security Operations
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.