Since I strayed a bit on #11 out of 26 Short Stories, I figured that this entry would be mostly a link-fest – about Layer 7.  A picture is worth a thousand words don’t cha know.  SANS just released a report that says ‘60% of All Attacks hit Web Applications,’ and other research indicates that 70% of all attacks target Layer 7. Today, I thought I would just share a list of common Layer 7 attacks to show the many ways applications can be breached.  List courtesy of Vikram Phatak.

HTTP

• Code Red, Nimda Worms & Mutations
• SQL Injection
• Directory Traversal Attacks
• MDAC Buffer Overflows
• Cross-Site Scripting Attacks
• Chunked Transfer Encoding Attacks

FTP

• FTP Bounce Attack
• FTP Port Injection Attacks
• Directory Traversal Attack
• TCP Segmentation Attack

Microsoft Networking

• Bugbear Worm
• Nimda Worm
• Liotan Worm
• Opaserv Worm

SSH

• Buffer Overflow Attack

SMTP

• SMTP Worm
• MIME Attacks
• SPAM Attack
• Command Verification Attack
• SMTP Error Denial-of-Service Attack
• Mailbox Denial-of-Service Attack (excessive email size)
• SMTP Mail Flooding
• Address Spoofing
• SMTP Buffer Overflow Attacks

DNS

• DNS Query Malformed Packet Attacks (pdf)
• DNS Answer Malformed Packet Attacks (pdf)
• DNS Query-Length Buffer Overflow
• DNS Query Buffer Overflow - Unknown Request/Response
• Man-in-the-Middle Attack

SNMP

• SNMP Flooding Attack
• Default Community Attacks
• Brute Force Attacks
• SNMP Put Attack

MS SQL

• Buffer Overflow attack
• SQL Slammer Worm

ps

• #12 out of 26 Short Topics about Security
• previous stories: 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1

Related links

• BIG-IP® Application Security Manager™