2.4 Web Application Exploits and OWASP Top 10 Vulnerabilities

🎯 Key CompTIA Security+ Exam Takeaways

• SQL Injection occurs when untrusted input alters database queries; parameterized queries (prepared statements) are the primary defense.
• Cross-Site Scripting (XSS) executes malicious scripts in victim browsers; setting the HttpOnly cookie flag prevents cookie theft via JavaScript.
• Cross-Site Request Forgery (CSRF) tricks browsers into executing state-changing actions; defended using unique anti-CSRF synchronization tokens.
• Server-Side Request Forgery (SSRF) coerces backend servers to query internal resources or cloud instance metadata (169.254.169.254).
• Buffer overflows overwrite memory execution pointers (EIP/RIP); mitigated by ASLR (address randomization) and DEP/NX (non-executable stack).

Application vulnerabilities represent the most frequently exploited attack vector against corporate perimeters. The Open Web Application Security Project (OWASP) Top 10 documents the most critical security risks. Injection attacks, particularly SQL Injection (SQLi), happen when user-supplied input is directly concatenated into SQL interpreter strings. Attackers inject boolean logic (such as `' OR 1=1 --`) to bypass authentication or extract entire database tables. The mandatory remediation is parameterized queries (prepared statements), which treat input strictly as data parameters rather than executable syntax.

Cross-Site Scripting (XSS) occurs when applications include unvalidated, unencoded user input in web pages. Stored XSS embeds malicious JavaScript directly into database records (e.g., comment boards), which executes in the browser of every subsequent visitor. In addition to contextual output encoding, securing session cookies with the `HttpOnly` flag prevents JavaScript (`document.cookie`) from reading sensitive session identifiers.

Cross-Site Request Forgery (CSRF) forces an authenticated user's browser to send unauthorized HTTP requests (e.g., money transfers, password changes) to a vulnerable site that trusts the user's active session cookie. Server-Side Request Forgery (SSRF) abuses a web server's ability to fetch remote resources, forcing the server to query internal networks or cloud metadata services (`169.254.169.254`) to steal IAM credentials. Memory vulnerabilities like buffer overflows overwrite adjacent execution pointers, requiring compiler bounds checking, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP/NX).

⚠️ Common Pearson VUE Exam Traps

• Relying on client-side JavaScript validation to prevent SQL injection; attackers easily bypass browser validation using proxy interceptors or curl.
• Confusing XSS with CSRF; XSS executes malicious code inside the victim's browser session, while CSRF tricks the browser into forging requests using existing credentials.