Application-Layer Attacks: Injection, XSS, CSRF, and Buffer Overflow

Application-Layer Attacks: Injection, XSS, CSRF, and Buffer Overflow

Why Application-Layer Attacks Matter

Application-layer attacks target the software logic of a web application rather than the network or operating system beneath it. Because modern organizations expose web applications directly to users, these vulnerabilities are among the most exploited in real-world breaches. The OWASP Top 10 consistently lists injection flaws and cross-site scripting (XSS) near the top of the most critical risks. Understanding how these attacks work is essential for both offensive testing (penetration testing) and defensive analysis (security operations).

Lab Safety and Isolation Requirements

Before any hands-on activity, network isolation is a hard requirement — not a suggestion. You must confirm that your virtual machine (VM) has no internet connectivity and no host-only bridge to a production network. Running attack tools or injecting payloads against any system you do not own, or any system connected to the internet, is illegal under the Computer Fraud and Abuse Act (CFAA) and similar state laws. Your instructor will verify isolation with a checklist before lab work begins. This is the cybersecurity equivalent of a lockout/tagout procedure: you verify the environment is safe before applying any potentially destructive action. Always work inside DVWA on your isolated, local VM only.

SQL Injection (SQLi)

SQL injection occurs when user-supplied input is inserted directly into a database query without proper sanitization or parameterization. The attacker adds SQL syntax to the input field, causing the database engine to interpret the attacker's commands as legitimate query logic.

How it works: Suppose an application builds a query like this:

```

SELECT * FROM users WHERE id = '[user input]';

```

If an attacker enters `1' OR '1'='1`, the query becomes:

```

SELECT * FROM users WHERE id = '1' OR '1'='1';

```

Because `'1'='1'` is always true, the database returns every row in the users table. More advanced payloads can retrieve password hashes, enumerate table names using `UNION SELECT` statements, or even write files to the server in some configurations.

Common payloads to try in DVWA (low security):

• `1' OR '1'='1` — returns all records
• `1' UNION SELECT user, password FROM users-- -` — attempts to retrieve credential data
• `1' AND 1=2 UNION SELECT null, table_name FROM information_schema.tables-- -` — enumerates table names

Record each payload, the exact response, and any data returned in your lab log. Note whether the application reveals database error messages — that itself is a finding (verbose error disclosure).

Cross-Site Scripting (XSS)

XSS occurs when an attacker injects malicious JavaScript (or other client-side script) into a web page that is then rendered and executed by another user's browser. The server trusts the stored or reflected content and passes it to the victim without sanitization.

There are three main types:

• Stored XSS: The malicious script is saved to the server's database and delivered to every user who views the affected page. This is the most dangerous type because it is persistent and requires no direct interaction with the attacker.
• Reflected XSS: The script is embedded in a URL and executed when the victim clicks the link. It is not stored on the server.
• DOM-based XSS: The attack manipulates the page's Document Object Model in the browser without the server ever seeing the payload.

In DVWA's stored XSS module, entering a payload such as `<script>alert('XSS')</script>` into a comment field causes the browser to execute that script every time the page loads. A real attacker would replace the `alert()` call with code that steals session cookies, redirects users to phishing sites, or logs keystrokes.

Cross-Site Request Forgery (CSRF)

CSRF tricks an authenticated user's browser into sending an unwanted request to a web application. Because the browser automatically includes session cookies, the application cannot distinguish the forged request from a legitimate one. CSRF does not steal data directly; it performs unauthorized actions on behalf of the logged-in victim — such as changing an email address or transferring funds. Defenses include anti-CSRF tokens and the `SameSite` cookie attribute.

Buffer Overflow

A buffer overflow happens when a program writes more data to a fixed-size memory buffer than it can hold. The excess data overwrites adjacent memory, potentially overwriting the return address of a function and redirecting execution to attacker-controlled code (shellcode). Buffer overflows are more common in compiled languages like C and C++. Modern defenses include stack canaries, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP/NX). Though less common in modern web applications, they remain relevant in embedded systems and legacy software.

Connecting to Your Credentials

The CompTIA Security+ (SY0-701) exam covers application attacks as part of its threat analysis objectives. CompTIA CySA+ expects analysts to identify attack indicators and recommend mitigations. ISC2 CC covers fundamental security concepts including common attack categories. This lab directly supports all three credential study areas by giving you hands-on exposure to the mechanics behind the theory.