Application Attack Indicators
Signs of application-level attacks including injection (SQL, command, XSS), buffer overflow attempts, replay attacks, privilege escalation, request forgery (CSRF/SSRF), and directory traversal. Recognizing these indicators enables faster detection.
Understanding Application Attack Indicators
Application attacks target software to steal data, gain access, or disrupt services. Recognizing attack indicators in application logs, behavior, and traffic enables detection before exploitation succeeds.
Key application attack categories: • Injection attacks — SQL injection, command injection, XSS • Memory attacks — Buffer overflow, format string • Session attacks — Replay, session hijacking • Access attacks — Privilege escalation, directory traversal • Forgery attacks — CSRF, SSRF
Application logs are the primary source for detecting these attacks.
Why This Matters for the Exam
Application attack indicators are heavily tested on SY0-701. Questions present log entries or behaviors and ask you to identify the attack type.
Understanding these indicators helps configure Web Application Firewalls (WAFs), tune intrusion detection systems, and investigate security incidents.
The exam tests both recognition of attack patterns and understanding of what makes each attack type distinct.
Deep Dive
Injection Attack Indicators
Signs of attempts to inject malicious code or commands.
SQL Injection Indicators:
| Indicator | Example |
|---|---|
| SQL keywords in input | ' OR '1'='1, UNION SELECT |
| Comment characters | --, /*, # |
| Database errors in response | "SQL syntax error" |
| Unusual query patterns in logs | Multiple OR conditions |
| Time-based delays | SLEEP(), WAITFOR DELAY |
SQL Injection Log Example:
- •```
- •GET /search?q=' UNION SELECT username,password FROM users--
- •```
| Command Injection Indicators: | |
|---|---|
| • Shell metacharacters in input: ; | & ` $() |
| • System command output in responses | |
| • Errors mentioning shell or command execution | |
| • Processes spawning unexpected child processes |
XSS Indicators:
- •Script tags in input:
- •Event handlers: onerror=, onload=
- •JavaScript protocol: javascript:
- •Encoded payloads: %3Cscript%3E
Buffer Overflow Indicators
Signs of memory corruption attempts.
Buffer Overflow Indicators:
| Indicator | Description |
|---|---|
| Oversized input | Input exceeding expected length |
| NOP sleds | Long sequences of 0x90 |
| Shellcode patterns | Known exploit code signatures |
| Application crashes | Segmentation faults, access violations |
| Unusual memory access | Out-of-bounds read/write errors |
Log Indicators:
- •Application crash logs
- •Memory dump generation
- •Core dump files created
- •Exception handling triggered
Replay Attack Indicators
Signs of captured and reused authentication.
Replay Attack Patterns:
- •Same request seen multiple times
- •Old timestamps in authentication
- •Expired tokens still being accepted
- •Authentication without interaction
- •Session tokens used from different IPs
Detection Indicators:
- •Duplicate transaction IDs
- •Timestamps significantly in the past
- •Same nonce values reused
- •Authentication from impossible locations
- •Actions without expected preceding actions
Prevention Evidence:
- •Timestamp validation failures
- •Nonce verification failures
- •Sequence number mismatches
Privilege Escalation Indicators
Signs of attempts to gain higher privileges.
Vertical Escalation Indicators:
- •User accessing admin functions
- •Attempts to modify role parameters
- •API calls to administrative endpoints
- •Changes to user privilege attributes
- •Access to /admin or /root paths
Horizontal Escalation Indicators:
- •IDOR attempts (changing user IDs in requests)
- •Accessing other users' data
- •Parameter manipulation to change context
- •Same user, different session resources
Common Patterns:
| Pattern | Example |
|---|---|
| IDOR | /user/profile?id=123 → id=456 |
| Role parameter | {"role":"user"} → {"role":"admin"} |
| Path traversal | /admin, /root, /management |
| Cookie manipulation | isAdmin=false → isAdmin=true |
Forgery Attack Indicators
Signs of request forgery attacks.
CSRF (Cross-Site Request Forgery) Indicators:
- •Requests missing CSRF tokens
- •Requests from unexpected referrers
- •State-changing operations via GET
- •Missing SameSite cookie attributes triggering
SSRF (Server-Side Request Forgery) Indicators:
- •Internal IP addresses in parameters (127.0.0.1, 10.x.x.x)
- •File URLs (file://)
- •Cloud metadata URLs (169.254.169.254)
- •Port scanning patterns from application
- •Unexpected outbound connections from servers
SSRF Payload Examples:
- •```
- •url=http://127.0.0.1/admin
- •url=http://169.254.169.254/latest/meta-data/
- •url=file:///etc/passwd
- •```
Directory Traversal Indicators
Signs of attempts to access files outside intended directories.
Traversal Patterns:
- •../ sequences in paths
- •URL-encoded traversal: %2e%2e%2f
- •Double encoding: %252e%252e%252f
- •Backslash variations: ..\
- •Path manipulation in parameters
Directory Traversal Indicators:
| Indicator | Example |
|---|---|
| Path sequences | ../../../etc/passwd |
| Null bytes | file.txt%00.jpg |
| System files accessed | /etc/passwd, /etc/shadow |
| Config file requests | web.config, .htaccess |
| WAF blocks on path patterns | Alert: traversal attempt |
Log Evidence:
- •```
- •GET /download?file=../../../etc/passwd
- •GET /image?path=....//....//etc/shadow
- •```
How CompTIA Tests This
Example Analysis
Scenario: Web application logs show the following request pattern from a single IP: ``` GET /profile?user_id=1001 GET /profile?user_id=1002 GET /profile?user_id=1003 ... GET /profile?user_id=2000 ``` The authenticated user's actual ID is 1001.
Analysis - IDOR/Horizontal Privilege Escalation:
Indicators Present: • Sequential user_id parameter testing • User accessing IDs beyond their own • Automated enumeration pattern (1001-2000) • Single IP making all requests
Attack Type: Insecure Direct Object Reference (IDOR) This is horizontal privilege escalation—accessing other users' data at the same privilege level.
What Attacker Is Doing: 1. Discovered user_id parameter controls access 2. Systematically testing all user IDs 3. Attempting to view other users' profiles 4. Likely automated tool or script
Why It Matters: • PII exposure if successful • No authorization check on object access • Affects all users, not just attacker
Detection: • Volume of profile requests unusual • Sequential ID patterns suspicious • Requests for IDs ≠ authenticated user • Rate limiting should have triggered
Response: 1. Block IP address 2. Implement proper authorization checks 3. Review if data was accessed 4. Notify affected users if breached 5. Consider rate limiting on sensitive endpoints
Key insight: IDOR is indicated by attempts to access resources belonging to other users by manipulating identifiers.