An educational overview of common cyber threats including Denial of Service (DoS), Distributed Denial of Service (DDoS), Man-in-the-Middle (MitM), SQL Injection (SQLi), and Cross-Site Scripting (XSS). Learn about their mechanics, targets, and common defense strategies.
In the modern digital landscape, security is not merely about building strong walls; it is about understanding how attackers attempt to scale those walls or slip through the cracks. Cyber threats generally fall into two broad categories: those that target the availability and integrity of the network itself, and those that exploit the way applications process data. By understanding the mechanics of Denial of Service (DoS), Man-in-the-Middle (MitM), and various injection attacks, security professionals can better implement defensive layers to protect sensitive information and maintain service continuity.
Network Availability Attacks: DoS and DDoS
Comparison of DoS and DDoS attack structures.
One of the most disruptive forms of attack is the Denial of Service (DoS) attack. The primary goal of a DoS attack is not necessarily to steal data, but to render a service, machine, or network resource unavailable to its intended users.
Denial of Service (DoS)
A DoS attack typically involves a single attacker sending a massive volume of traffic or malformed requests to a target system. This overwhelms the target's resources—such as CPU, memory, or network bandwidth—causing the system to slow down significantly or crash entirely.
Distributed Denial of Service (DDoS)
A Distributed Denial of Service (DDoS) attack is a more sophisticated and harder-to-defend version of the DoS attack. Instead of one source, the attacker uses a "botnet"—a collection of many compromised computers or IoT devices spread across the globe.
Because the attack traffic originates from thousands of different IP addresses simultaneously, it is extremely difficult for the victim to distinguish between legitimate users and malicious traffic. This makes simple IP blocking ineffective and requires advanced scrubbing services to mitigate.
Exam Tip: If a question asks about an attack involving a "botnet" or "multiple distributed sources" to overwhelm a server, the answer is almost certainly a DDoS attack.
Interception Attacks: Man-in-the-Middle (MitM)
This diagram illustrates a man-in-the-middle attack where an attacker intercepts and potentially modifies data transmitted between a user and a server.
While DoS attacks target availability, Man-in-the-Middle (MitM) attacks target confidentiality and integrity. In a MitM attack, the perpetrator positions themselves between two communicating parties—typically a user and a web server—to intercept or alter the data being exchanged.
How MitM Works
Imagine Alice is trying to send a private message to Bob. In a MitM scenario, Eve sits on the network path. When Alice sends her message, Eve intercepts it, reads it (violating confidentiality), and perhaps even changes the content before forwarding it to Bob (violating integrity). Bob receives the message, believing it came directly and unchanged from Alice.
Common methods for executing MitM attacks include:
ARP Spoofing: Sending fake Address Resolution Protocol messages to link the attacker's MAC address with the IP address of a legitimate server on a local network.
DNS Spoofing: Corrupting the Domain Name System to redirect users to a fraudulent website that looks identical to the real one.
Wi-Fi Eavesdropping: Setting up "Evil Twin" access points in public spaces to trick users into connecting to a network controlled by the attacker.
To defend against these, organizations must enforce strong encryption protocols like TLS (Transport Layer Security) to ensure that even if data is intercepted, it remains unreadable.
Data Exploitation: Injection Attacks
This diagram illustrates a SQL injection attack where malicious input in a web form bypasses security checks in the application logic, leading to an altered SQL query that can compromise the database.
Injection attacks occur when an attacker supplies untrusted input to an application, which is then executed as part of a command or query. This is one of the most dangerous classes of vulnerabilities because it allows attackers to bypass authentication or steal entire databases.
SQL Injection (SQLi)
SQL Injection targets the database layer. Most web applications use Structured Query Language (SQL) to communicate with databases. If an application does not properly "sanitize" user input, an attacker can insert their own SQL commands into an input field (like a login box or a search bar).
Worked Example:
Consider a standard login query:
SELECT * FROM users WHERE username = '[user_input]' AND password = '[password_input]';
An attacker might enter ' OR '1'='1 into the username field. The resulting query becomes:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = '...';
Because '1'='1' is always true, the database may grant access to the first user in the table (often the administrator) without a valid password.
Cross-Site Scripting (XSS)
While SQLi targets the server-side database, Cross-Site Scripting (XSS) targets the users of a website. In an XSS attack, the attacker injects malicious scripts (usually JavaScript) into a web page viewed by other users.
There are three main types of XSS:
Stored XSS: The malicious script is permanently stored on the target server (e.g., in a comment section or user profile). Every user who views that page executes the script.
Reflected XSS: The script is "reflected" off a web server, often through a malicious link in an email or a URL parameter.
DOM-based XSS: The vulnerability exists in the client-side code rather than the server-side code, where the script manipulates the Document Object Model (DOM) of the page.
When the script executes in a victim's browser, it can steal session cookies, redirect the user to malicious sites, or capture keystrokes.
Summary Table of Attacks
Attack Type
Primary Target
Goal
Common Defense
DoS/DDoS
Network/Server Availability
Disrupt service
Rate limiting, Scrubbing services
MitM
Communication Channel
Intercept/Alter data
Encryption (TLS/SSL), VPNs
SQLi
Database/Backend
Steal or modify data
Parameterized queries, Input validation
XSS
End-user Browser
Steal sessions/credentials
Output encoding, Content Security Policy (CSP)
Security Pro Tip: The most effective way to prevent injection attacks is the principle of "Never Trust User Input." Always treat data coming from a user as potentially malicious and validate, sanitize, or parameterize it before use.
Keep reading for free.
Create an account to finish this reading and make it part of your study routine.
