2.3 Explain various types of vulnerabilities

★ Starred in your notes: zero-day · directory traversal (%2E%2E%2F).

Breakdown 1 — Application vulnerabilities

Vulnerability	What happens	Defense
Memory injection	Attacker gets code into a process's memory (DLL injection, shellcode)	DEP, ASLR, EDR
Buffer overflow	Input larger than the buffer overwrites adjacent memory → crash or code execution	Input validation, bounds checking, DEP/ASLR
Race condition — TOC/TOU	Time-of-check to time-of-use: the program checks a condition, then acts, but the state changed in between	Atomic operations, locking
Malicious update	A legitimate update channel delivers malware (supply chain)	Code signing, verify hashes, staged rollout

From class — Chapter 12: Application exploits: privilege escalation, directory traversal (../ — URL-encoded as %2E%2E%2F, "2E 2E 2F"), arbitrary code execution, resource exhaustion. Input manipulation; memory overflow; race conditions (buffer overflow, TOC/TOU); malicious update. Know OWASP Top 10 exists — the top web attacks with remediation guidance.

Breakdown 2 — Web-based

Vulnerability	Key facts (class + exam)
SQL injection (SQLi)	Untrusted input reaches a database query: ' OR 1=1--. Defend: sanitize, validate, restrict, minimize (class list) — i.e., parameterized queries/stored procedures, input validation, least-privilege DB accounts.
Cross-site scripting (XSS)	Attacker's script runs in another user's browser. "Look for <>" in input; can steal cookies/sessions. Stored/persistent (saved on the server — the worst), reflected/non-persistent (bounced off a URL), DOM-based (happens entirely in client-side JavaScript). Defend: output encoding, input validation, HttpOnly cookies, CSP.
CSRF/XSRF	Victim's browser is tricked into sending a request it's already authenticated for (change password, transfer funds). Defend: anti-CSRF tokens, SameSite cookies.

Breakdown 3 — Platform vulnerabilities

Area	Vulnerabilities
OS-based	Unpatched kernel/services, misconfigured permissions, default accounts
Hardware	Firmware (UEFI/BIOS implants), end-of-life (no more patches), legacy (can't be upgraded)
Virtualization	VM escape (break out of the guest to the hypervisor/host), resource reuse (data left in memory/disk reallocated to another tenant)
Cloud-specific	Misconfigured storage buckets, over-permissive IAM, shared-tenancy risk — "when the cloud gets compromised it can affect others; think of a fire in one apartment" (class), API exposure
Supply chain	Service provider, hardware provider, software provider compromise
Cryptographic	Weak/deprecated algorithms (DES, RC4, MD5, SHA-1), short keys, bad randomness, downgrade-able protocols
Misconfiguration	Open ports, default creds, debug mode on, verbose errors, implicit allow
Mobile device	Side loading (installing apps outside the store), jailbreaking/rooting (removing OS protections)
Zero-day	"Vendor does not have a patch" (class) — exploited before a fix exists

From class — host attack surfaces (Chapter 9): software vulnerabilities (malware, open service ports, unpatched software, unauthorized systems and software), security misconfigurations, legacy platforms.

Breakdown 4 — Hypervisors (know for VM questions)

• Type 1 / bare-metal hypervisor is installed directly on hardware (ESXi, Hyper-V, Xen).
• Type 2 hypervisor runs on top of a host OS (VirtualBox, VMware Workstation).
• VM escape is worse on shared/multi-tenant infrastructure; VM sprawl = too many unmanaged VMs.

Breakdown 5 — How the exam asks it

• "Program checks a file's permissions, then opens it, but the file was swapped in between" → race condition / TOC-TOU.
• "URL contains ../../etc/passwd" or %2E%2E%2F → directory traversal.
• "Script in a forum post runs for every visitor" → stored XSS.
• "Link in an email contains <script> that echoes back" → reflected XSS.
• "Attack works because the user is still logged in to their bank" → CSRF.
• "Guest VM reads another tenant's leftover memory" → resource reuse.
• "Vendor announced the product is no longer supported" → end-of-life — mitigate with isolation/compensating controls.
• "Unknown exploit, no patch" → zero-day.

Quick self-check

• Stored vs. reflected XSS? (Stored lives on the server and hits everyone; reflected needs the victim to click a crafted link.)
• Four defenses against SQLi from class? (Sanitize, validate, restrict, minimize.)
• What is %2E%2E%2F? (URL-encoded ../ — directory traversal.)