Browser-based attacks use flaws in the web-based application code. Software most vulnerable to these types of attacks includes:

• User interface code — provides the look and feel of the site
• Web server — supports the physical communication between the user’s browser and the web applications
• Front-end applications — interfaces directly with the user interface code, and back-end systems

 Example scenarios in which a web site is compromised:

Examples of vulnerabilities

Hack attack	What hackers use it for
1. Cookie Poisoning	Identity theft/ Session Hijack
2. Hidden Field Manipulation	eShoplifting
3. Parameter Tampering	Fraud
4. Buffer Overflow	Denial of Service/ Closure of Business
5. Cross-Site Scripting	Hijacking/ Identity Theft
6. Backdoor and Debug Options	Trespassing
7. Forceful Browsing	Breaking and Entering
8. HTTP Response Splitting	Phishing, Identity Theft and eGraffiti
9. Stealth Commanding	Concealing Weapons
10. 3rd Party Misconfiguration	Debilitating a Site
11. Known Vulnerabilities	Taking control of the site
12. XML & Web Services Vulnerabilities	New layers of attack vectors & malicious use
13. SQL Injection	Manipulation of DB information

How do these Vulnerabilities Affect Your Customers?

Your customers can be affected in a variety of ways: from identity theft to session hijacking to the compromise of confidential and private customer data. Cross-Site Scripting (XSS) is one of the leading methods used in identity theft (and an obvious concern to financial and healthcare institutions); it attacks the user via a flaw in the website that enables the attacker to gain access to login and account data from the user. Many of the phishing email-based schemes use cross-site scripting and other application layer attacks to trick users into giving up their credentials.

SQL injection is one of the main attacks used when backend databases are compromised. General consensus has pegged SQL injection as the method used behind the massive compromise of credit card numbers in February of last year. We still see many cases where cookies aren’t properly secured, allowing an attacker to ‘poison’ the cookie, hijack active sessions or manipulate hidden fields to defraud ecommerce sites. As web applications become more pervasive and more complex, so do the techniques and attacks hackers are using against them. Recent new vulnerabilities and attack methods discovered or reported show an alarming trend toward attacks with multi-faceted damages and even anti-forensics capabilities. This means hackers are using more powerful attacks to cause significantly more damage, while at the same time covering their tracks is becoming easier.