Unit 03 of 03
Technical Attack Classes
Measuring application- and system-layer attack classes as a step-to-control mapping: how common risk lists are read and why the ranking changes by organization, which defense layer breaks which step in the injection, cross-site scripting, request forgery, and path traversal classes, how buffer overflow corrupts the neighboring item in the bounded-array model, the cost difference between brute-force, dictionary, and spraying forms against lockout and rate limiting, the precondition chain of browser-based infection, and the place of reverse engineering in defense.
Published Updated
Lessons
- 01 Web Application Risks Measuring that common risk lists are a way of reading, not a ranking: six of ten fictional items changing places between the overall ranking and the organizational ranking, the largest shift being four places, twenty-two of the thirty-nine steps across nine chains remaining uncontrolled, one chain never being breakable at runtime, and the defense's break order overlapping the organizational ranking in only one of three items. 13 min read
- 02 Injection Attacks Measuring the injection class as a six-step chain: which step each of the six defense layers breaks, the absence of a control in forty-two of the seventy-two step-site combinations across twelve call sites, the three-layer paper design being complete at only one call site, six of the one hundred ninety-two input-site combinations completing all six steps, and those six concentrating at two call sites. 13 min read
- 03 Cross-Site Scripting Measuring the three forms as separate step sequences: reflected five, stored six, DOM-based four steps; the number of steps the three server-side layers break in the DOM-based form being zero, no link breaking in three of the twenty-four combinations across eight pages, the daily cost of one hundred ninety sessions for the seven combinations broken only at the last step, and a single browser-side layer closing off all three forms at once. 13 min read
- 04 Request Forgery Measuring the two directions of request forgery as separate chains: in the browser direction, the five steps' preconditions are split between the victim, the browser, and the server; in the server direction, forty percent of the cost is realized at the third step; two of eleven endpoints cannot be broken at all; removing a single layer produces a forty-five-transaction difference; and the two directions' costs are measured in separate units. 13 min read
- 05 Path Traversal Measuring path traversal as a five-step chain and a count of accessible items: in a thirty-item fictional inventory, the root check brings the item count down to twelve and the sensitivity down to seven; the narrow process identity removes no items within the jail; the identifier mapping breaks the chain at the second step and leaves ten items; and the jail, which breaks no step at all, brings the sensitivity down from forty-one to twenty. 13 min read
- 06 Buffer Overflow Measuring buffer overflow in a bounded-array model: in a thirty-two-byte region, eleven copy lengths corrupt thirty-three neighboring fields in total; the guard value is corrupted in four of eleven cases; the corrupted return label stays valid in neither of the two cases it is corrupted in; the bounds check catches nine of eleven cases; and in one of six components, no link can be broken at all. 13 min read
- 07 Password Attacks Separating three password-attack forms along the cost-and-threshold axis: across four hundred fictional accounts, brute force drops one hundred ninety, dictionary one hundred eighty, and spraying eighteen; account lockout stops two of the three forms and cuts the number of dropped accounts by eighty-seven percent; spraying, at three attempts per account, never triggers the lockout threshold at all; and the total legitimate-work cost of the two thresholds that see all three forms is four. 12 min read
- 08 Drive-By Downloads Counting browser-based infection as a precondition chain: across six hundred fictional endpoints, all six of six conditions hold at once in only twenty-two of them; the item has already been written to disk at seventy-three endpoints that hold through the fourth condition; the single most effective defense on its own brings the remainder down to one; the defense that breaks two conditions at once ends up the weakest because its coverage is narrow; and two defenses reach, with a legitimate-work cost of nine, the same result that seven defenses reach with a cost of fifty-five. 13 min read
- 09 Reverse Engineering Fundamentals Measuring reverse engineering's place in defense: the total defense value of twenty fictional indicators being thirty-eight, twelve items coming out of the raw binary through a string scan, symbol stripping together with string hiding bringing those twelve down to zero, three items being impossible to extract in any deployment and visible only in the victim's own record, and the chain columns of the course's twenty-two lessons being gathered into a single table. 12 min read