Types of Cyber Attacks

Types of Cyber Attacks
A cyber-attack is an exploitation of computer systems and networks. It uses

malicious code to alter computer code, logic or data and lead to
cybercrimes, such as information and identity theft.
We are living in a digital era. Now a day, most of the people use computer
and internet. Due to the dependency on digital things, the illegal computer
activity is growing and changing like any type of crime.
Cyber-attacks can be classified into the following categories:
Web-based attacks
These are the attacks which occur on a website or web applications. Some
of the important web-based attacks are as follows-
1. Injection attacks
It is the attack in which some data will be injected into a web application to
manipulate the application and fetch the required information.
Example- SQL Injection, code Injection; log Injection, XML Injection etc.
Cross-site scripting (XSS). That involves an attacker uploading a piece of

malicious script code onto your website that can then be used to steal data
or perform other kinds of mischief. Although this strategy is relatively
unsophisticated, it remains quite common and can do significant damage.
SQL Injection (SQLI). This happens when a hacker submits destructive
code into an input form. If your systems fail to clean this information, it can
be submitted into the database, changing, deleting, or revealing data to the
attacker.
A successful SQL injection attack can result in unauthorized access to

sensitive data, such as:
 Passwords.
 Credit card details.
 Personal user information.
XML Injection:
XML (Extensible Markup Language) is a markup language used to store
and transport data. It is designed to be self-descriptive and allows users
to define their own tags, making it highly customizable. XML is commonly
used for data storage, configuration files, and web services.
XML Injection is a type of attack that targets web applications that

generate XML content. Attackers use malicious code to exploit
vulnerabilities in XML parsers to manipulate the content of an XML
document. This can result in unauthorized access to sensitive data, denial
of service, and other potential risks to the application and its users
Potential risks of XML Injection

 Unauthorized access to sensitive data: XML Injection can allow attackers to
access sensitive information such as user credentials, financial data,
personal identifiable information (PII), and more.
 Denial of service attacks: Attackers can send large amounts of data to web
applications using XML Injection, causing them to become unresponsive,
crash, or slow down.
 Data manipulation or corruption: Attackers can modify or delete XML data,
causing incorrect data to be displayed or processed by web applications.
2. DNS Spoofing
Before Discussing DNS Spoofing, First, discuss what DNS is.

A Domain Name System (DNS) converts a human-readable name (such
as www.geeksforgeeks.org) to a numeric IP address. A DNS server is used
for the purpose of resolving a domain name (such as keycdn.com) into the
associated IP address that it maps to. Once the DNS server finds the
appropriate IP address, data transfer can begin between the client and
website's server. The visualization below shows a how this process takes
place at a high level.
When you type a domain name into your web browser, your computer
sends a request to a DNS server asking for the IP address associated with
that domain name. The DNS server then looks up the IP address and sends
it back to your computer, allowing you to connect to the website you want
to visit.
DNS spoofing is a type of cyber attack in which a hacker intercepts DNS

requests and sends back false information in response. For example, if you
try to visit google.com, a hacker could intercept your DNS request and send
back a fake IP address that leads to a malicious website instead.
The purpose of DNS spoofing is usually to redirect users to a fake website
that looks like the real one. This is known as a phishing attack, and it can be
used to steal sensitive information such as login credentials, credit card
numbers, and more.
In above image –
1. Request to Real Website: User hits a request for a particular website it
goes to the DNS server to resolve the IP address of that website.
2. Inject Fake DNS entry: Hackers already take control over the DNS server
by detecting the flaws and now they add false entries to the DNS
server.
3. Resolve to Fake Website: Since the fake entry in the DNS server redirect
the user to the wrong website.
3. Session Hijacking
It is a security attack on a user session over a protected network. Web

applications create cookies to store the state and user sessions. By stealing
the cookies, an attacker can have access to all of the user data.
Example of how session hijacking might work:
An internet user logs into an account as normal. This might be their online
bank or credit card account, an online store, an application, or portal. The
application or website installs a temporary session cookie in the user’s
browser. That cookie contains information about the user that allows the
site to keep them authenticated and logged in and to track their activity
during the session. The session cookie remains in the browser until the user
logs out (or is automatically logged out after a set period of inactivity).
What is a session?
A session refers to the interactions between a user and a website within a

given timeframe, typically starting from the moment of authentication until
the user logs out or the session expires due to inactivity.
What is a session ID?
Every session that is created is assigned a unique identifier known as a

session ID or session token. This session ID is then used to identify and
associate subsequent requests you make within your ongoing session.
The session ID is usually stored in a cookie or included in the URL as a
query parameter. It allows the server to recognize you and maintain the
session state, regardless of the requests you make or the pages you visit on
that website. During a session, the server may store relevant user data or
session-specific information, including your preferences, the contents of
your shopping cart, your temporary authentication credentials, and more.
4. Brute force
It is a type of attack which uses a trial and error method. This attack
generates a large number of guesses and validates them to obtain actual
data like user password and personal identification number. This attack may
be used by criminals to crack encrypted data, or by security, analysts to test
an organization's network security.
5. Dictionary attacks
This type of attack stored the list of a commonly used password and
validated them to get original password.
6. Man in the middle attacks
It is a type of attack that allows an attacker to intercepts the connection

between client and server and acts as a bridge between them. Due to this,
an attacker will be able to read, insert and modify the data in the
intercepted connection.
7. Phishing attack
System-based attacks
These are the attacks which are intended to compromise a computer or a

computer network. Some of the important system-based attacks are as
follows-
1. Virus
It is a type of malicious software program that spread throughout the

computer files without the knowledge of a user. It is a self-replicating
malicious computer program that replicates by inserting copies of itself into
other computer programs when executed. It can also execute instructions
that cause harm to the system.
2. Worm
It is a type of malware whose primary function is to replicate itself to spread

to uninfected computers. It works same as the computer virus. Worms
often originate from email attachments that appear to be from trusted
senders.
3. Ransomware attack
Ransomware is a malware designed to deny a user or organization access

to files on their computer. By encrypting these files and demanding a
ransom payment for the decryption key, cyber attackers place organizations
in a position where paying the ransom is the easiest and cheapest way to
regain access to their files.
4. Malware
Malware is unwanted software installed on a system without permission,

which can infect computers through legitimate websites, applications, or
file attachments. Different types of malware have varying methods of
infection, such as replicating, encrypting files, blocking access to data,
displaying ads, or collecting information.

Types of Cyber Attacks

Uploaded by

Copyright:

Available Formats

Types of Cyber Attacks

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Types of Cyber Attacks

Uploaded by

Copyright:

Available Formats

Types of Cyber Attacks

A cyber-attack is an exploitation of computer systems and networks. It uses

Cyber-attacks can be classified into the following categories:

Cross-site scripting (XSS). That involves an attacker uploading a piece of

A successful SQL injection attack can result in unauthorized access to

used for data storage, configuration files, and web services.

XML Injection is a type of attack that targets web applications that

Potential risks of XML Injection

Before Discussing DNS Spoofing, First, discuss what DNS is.

DNS spoofing is a type of cyber attack in which a hacker intercepts DNS

It is a security attack on a user session over a protected network. Web

Example of how session hijacking might work:

A session refers to the interactions between a user and a website within a

the user logs out or the session expires due to inactivity.

What is a session ID?

Every session that is created is assigned a unique identifier known as a

6. Man in the middle attacks

It is a type of attack that allows an attacker to intercepts the connection

These are the attacks which are intended to compromise a computer or a

It is a type of malicious software program that spread throughout the

It is a type of malware whose primary function is to replicate itself to spread

Ransomware is a malware designed to deny a user or organization access

regain access to their files.

Malware is unwanted software installed on a system without permission,

displaying ads, or collecting information.

You might also like