Master Common Web & Network Attacks: SQL Injection, XSS, CSRF, DDoS & More

SQL Injection Attack

Attackers inject malicious SQL into HTTP requests; when the server builds SQL statements from parameters, the malicious code is executed, allowing unauthorized data access.

select * from user where name = 'lianggzone' and password = '' or '1'='1'

Prevention: use prepared statements, validate input length, and perform server‑side validation.

Cross‑Site Scripting (XSS) Attack

Attackers embed malicious scripts into webpages, which run in victims' browsers to perform unauthorized actions.

Limit input length on both client and server.

Escape HTML characters such as < and > before rendering.

CSRF Attack

Attackers trick authenticated users into sending forged requests to a target site, performing actions like sending emails or transferring funds.

Use security frameworks (e.g., Spring Security).

Implement token verification.

Employ CAPTCHA where appropriate.

Validate the HTTP Referer header.

File Upload Vulnerability

Uploading executable scripts can give attackers the ability to execute commands on the server.

Validate file type using MIME and extensions.

Apply a whitelist of allowed types.

Rename uploaded files to obscure paths.

Restrict file size.

Serve uploads from a dedicated domain.

DDoS Attack

Attackers flood a server with SYN half‑open connections, exhausting resources.

Limit the number of simultaneous SYN half‑open connections.

Reduce SYN timeout.

Disable unnecessary services.

ARP Protocol

ARP resolves IP addresses to MAC addresses by broadcasting a request and receiving a reply.

Prevention methods include MAC address binding, static ARP tables, ARP‑guard software, and isolating compromised hosts.

RARP Protocol

RARP performs the reverse operation, allowing a host that knows only its MAC address to discover its IP address via a RARP server.

DNS Working Principle

Clients resolve domain names to IP addresses through a hierarchy of caches and recursive/iterative queries involving root, TLD, and authoritative name servers.

RIP Routing Protocol

RIP uses distance‑vector routing with a maximum hop count of 15, broadcasting updates every 30 seconds via UDP 520.

Convergence mechanisms include split horizon, hold‑down timers, and triggered updates.

OSPF Protocol

OSPF is a link‑state routing protocol that discovers neighbors with Hello packets, exchanges LSAs, builds a link‑state database, and computes shortest paths using the SPF algorithm.

TCP vs. UDP

TCP is connection‑oriented, reliable, and provides flow and congestion control.

UDP is connection‑less, low‑overhead, and suitable for real‑time or small‑payload traffic.

TCP Three‑Way Handshake & Four‑Way Teardown

Handshake establishes a reliable connection (SYN, SYN‑ACK, ACK); teardown gracefully closes it with FIN and ACK exchanges.

GET vs. POST

GET appends parameters to the URL (limited size, cacheable, idempotent); POST sends data in the request body (larger payloads, not cached, non‑idempotent).

Cookies vs. Sessions

Cookies store data client‑side as strings; sessions store data server‑side as objects.

Cookies are limited to ~4 KB and expire with the browser; sessions expire after inactivity.

SSL/TLS

SSL/TLS provides authentication, confidentiality, and integrity using asymmetric key exchange to establish a symmetric session key, then encrypting traffic.

Client initiates handshake and receives server certificate.

Server’s public key encrypts a random secret.

Both sides derive the shared session key.

All subsequent data is encrypted with the session key.

TCP‑Based Application Protocols

FTP (port 21), Telnet (23), SMTP (25), POP3, HTTP.

UDP‑Based Application Protocols

DNS (53), SNMP (161), TFTP (69).