Recognizing common attacks

Attacks against systems and software are a real threat, based on the fact that systems need to be made accessible to business users and customers. For web applications, the typical scenario is a customer-facing application server behind a firewall, able to communicate with intranet-based services. A typical deployment can be seen in Figure 7.7, where the inputs will be through web-based forms run on the client browser and the results forwarded to the web application server:

Figure 7.7 – Web application server located in DMZ

When we secure our networks using secured firewalls, it is difficult to attack the intranet services directly, so it is the web application server that is targeted. This is where the attacker will direct the attacks. In this section, we will focus on attacks that use the model shown in Figure 7.7.

Directory traversal

Directory traversal is when an attacker can input syntax that allows them to move...