Network Attacks, Malware, and Web Application Security

Week 5 · Week 5: Network Attacks, Malware, and Web Application Security · Download .docx

Objectives

Explain how ARP poisoning enables man-in-the-middle attacks on local networks
Classify malware types by propagation and concealment mechanism
Identify SQL injection, XSS, and CSRF and state the definitive defensive control for each
Explain session hijacking and describe how session tokens should be protected
Map the OWASP Top 10 injection category to the attack types it covers

Key terms

ARP poisoning: Sending forged ARP replies that associate the attacker's MAC address with a legitimate IP — enabling man-in-the-middle traffic interception.
Packet sniffing: Capturing and analyzing network traffic to inspect packet contents — authorized on designated lab network segments only.
Session hijacking: Taking over an established user session by stealing or predicting the session token, bypassing authentication entirely.
SQL injection: Inserting database commands into input fields, causing the database to execute unintended queries — prevented definitively by parameterized queries.
XSS: Cross-Site Scripting — injecting malicious scripts into web pages that execute in other users' browsers.
CSRF: Cross-Site Request Forgery — tricking an authenticated user's browser into submitting unauthorized requests to a trusted site.
Ransomware: Malware that encrypts victim data and demands payment for the decryption key.
Rootkit: Malware that hides its presence from the operating system and security tools by hooking into system calls.
Worm: Self-replicating malware that spreads across network services without requiring a host file or user action.
IOC: Indicator of Compromise — forensic artifacts indicating system compromise or active intrusion.
Parameterized query: A prepared SQL statement that separates code from data — the definitive defense against SQL injection.

The concept

Network-layer attacks exploit the fundamental design assumptions of the protocols that make modern networks function. ARP poisoning exploits the trust model of the Address Resolution Protocol: ARP has no authentication — any host on the local segment can broadcast a forged ARP reply claiming any IP-to-MAC mapping. When the attacker poisons the ARP caches of two communicating hosts, both hosts send their traffic through the attacker's system, enabling interception, modification, or logging of all communications. The defense is dynamic ARP inspection (DAI) on managed switches, which validates ARP replies against a DHCP snooping binding table.

Packet sniffing captures network traffic for analysis — Wireshark is the standard tool. In an authorized context, sniffing reveals cleartext credentials, session tokens, and unencrypted application data that organizations may not realize are exposed on their networks.

Malware is classified by propagation mechanism and concealment behavior. A virus attaches to a legitimate file and replicates when that file is executed — it requires user action or file execution to spread. A worm self-replicates across network services without a host file or user action — exploiting vulnerabilities in network-accessible services to propagate autonomously. A Trojan masquerades as legitimate software, delivering a malicious payload when installed. Ransomware encrypts the victim's data and demands payment for the decryption key. A rootkit hooks into the operating system or kernel to hide its presence, making infected processes, files, and network connections invisible to standard security tools.

Web application attacks operate at the application layer and target the interface between users and databases. SQL injection inserts database commands into input fields — a form field designed to accept a username instead receives SQL syntax that changes the query's logic. The only definitive defense is parameterized queries (prepared statements), which structurally separate SQL code from user-supplied data so that input can never be interpreted as executable SQL. Character filtering is insufficient — encoding bypasses exist for virtually every filter.

XSS (Cross-Site Scripting) injects scripts into pages served to other users. The injected script executes in the victim's browser under the trusted site's origin — enabling cookie theft, session hijacking, and browser-based exploitation. CSRF (Cross-Site Request Forgery) exploits the browser's automatic inclusion of session cookies: an attacker's page causes the victim's authenticated browser to submit a forged request to a trusted site the victim is logged into. The defense for CSRF is a server-generated, session-specific CSRF token embedded in every state-changing form.

Session tokens require specific protections. The HttpOnly cookie attribute prevents JavaScript from reading the cookie value — blocking XSS-based theft. The Secure attribute restricts transmission to HTTPS connections. Regenerating the session token after login prevents session fixation. Together, these controls protect the session token through its lifecycle.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 8 (Sniffing) + Domain 9 (Session Hijacking) + Domain 12 (Web Applications) · PGCC INT-2681 Outcomes 3, 4, 5.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Believing that filtering single-quote characters prevents SQL injection. Encoding bypasses (URL encoding, Unicode variations, hex representations) defeat character-level filtering — only parameterized queries provide complete protection.
Confusing XSS and CSRF. XSS injects scripts into the target site that execute in victims' browsers. CSRF exploits victims' existing authenticated sessions from a different, attacker-controlled site.
Assuming HTTPS prevents web application attacks. HTTPS encrypts the transport channel — it does not prevent SQL injection, XSS, or CSRF, which exploit application-layer logic.
Treating Wireshark as an attack tool. Wireshark is a protocol analyzer — using it on an authorized network segment for traffic analysis is legitimate; using it to intercept credentials outside an authorized scope is unauthorized.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. SQL injection is definitively prevented by:

2. ARP poisoning enables man-in-the-middle attacks by:

3. The HttpOnly cookie attribute protects session tokens against:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top