PHISHING:

Phishing is a form of fraud in which the attacker tries to learn information such as login
credentials or account information by masquerading as a reputable entity or person in email, IM
or other communication channels.
Typically a victim receives a message that appears to have been sent by a known contact or
organization. An attachment or links in the message may install malware on the users device or
direct them to a malicious website set up to trick them into divulging personal and financial
information, such as passwords, account IDs or credit card details. Phishing is a homophone of
fishing, which involves using lures to catch fish.
Phishing is popular with cybercriminals, as it is far easier to trick someone into clicking a
malicious link in a seemingly legitimate email than trying to break through a computers
defenses. Although some phishing emails are poorly written and clearly fake, sophisticated
cybercriminals employ the techniques of professional marketers to identify the most effective
types of messages -- the phishing "hooks" that get the highest "open" or click through rate and
the Facebook posts that generate the most likes. Phishing campaigns are often built around the
year's major events, holidays and anniversaries, or take advantage of breaking news stories, both
true and fictitious.
To make phishing messages look like they are genuinely from a well-known company, they
include logos and other identifying information taken directly from that companys website. The
malicious links within the body of the message are designed to make it appear that they go to
the spoofed organization. The use of subdomains and misspelled URLs (typosquatting) are
common tricks, as is homograph spoofing -- URLs created using different logical characters to
read exactly like a trusted domain. Some phishing scams use JavaScript to place a picture of a
legitimate URL over a browsers address bar. The URL revealed by hovering over an embedded
link can also be changed by using JavaScript.
BUFFER OVERFLOW
In computer security and programming, a buffer overflow, or bufferoverrun, is an anomaly
where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites
adjacent memory locations. This is a special case of the violation of memory safety.

A buffer overflow condition exists when a program attempts to put more data in a buffer than it
can hold or when a program attempts to put data in a memory area past a buffer. In this case, a
buffer is a sequential section of memory allocated to contain anything from a character string to
an array of integers. Writing outside the bounds of a block of allocated memory can corrupt data,
crash the program, or cause the execution of malicious code.
Attackers use buffer overflows to corrupt the execution stack of a web application. By sending
carefully crafted input to a web application, an attacker can cause the web application to execute
arbitrary code effectively taking over the machine.
Buffer overflow flaws can be present in both the web server or application server products that
serve the static and dynamic aspects of the site, or the web application itself. Buffer overflows
found in widely used server products are likely to become widely known and can pose a
significant risk to users of these products. When web applications use libraries, such as a
graphics library to generate images, they open themselves to potential buffer overflow attacks.

Format string attacks:

The Format String exploit occurs when the submitted data of an input string is evaluated as a
command by the application. In this way, the attacker could execute code, read the stack, or

cause a segmentation fault in the running application, causing new behaviors that could
compromise the security or the stability of the system.
To understand the attack, its necessary to understand the components that constitute it.
The Format Function is an ANSI C conversion function, like printf, fprintf, which converts a
primitive variable of the programming language into a human-readable string representation.
The Format String is the argument of the Format Function and is an ASCII Z string which
contains text and format parameters, like: printf ("The magic number is: %d\n", 1911);
The Format String Parameter, like %x %s defines the type of conversion of the format
function.
The attack could be executed when the application doesnt properly validate the submitted input.
In this case, if a Format String parameter, like %x, is inserted into the posted data, the string is
parsed by the Format Function, and the conversion specified in the parameters is executed.
However, the Format Function is expecting more arguments as input, and if these arguments are
not supplied, the function could read or write the stack.
In this way, it is possible to define a well-crafted input that could change the behavior of the
format function, permitting the attacker to cause denial of service or to execute arbitrary
commands.
If the application uses Format Functions in the source-code, which is able to interpret formatting
characters, the attacker could explore the vulnerability by inserting formatting characters in a
form of the website. For example, if the printf function is used to print the username inserted in
some fields of the page, the website could be vulnerable to this kind of attack, as showed below:
printf (userName);

SQL INJECTION:
SQL injection is a code injection technique, used to attack data-driven applications, in which
malicious SQL statements are inserted into an entry field for execution (e.g. to dump the
database contents to the attacker).
SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious
SQL statements (also commonly referred to as a malicious payload) that control a web
applications database server (also commonly referred to as a Relational Database Management
System RDBMS). Since an SQL injection vulnerability could possibly affect any website or
web application that makes use of an SQL-based database, the vulnerability is one of the oldest,
most prevalent and most dangerous of web application vulnerabilities.
By leveraging an SQL injection vulnerability, given the right circumstances, an attacker can use
it to bypass a web applications authentication and authorization mechanisms and retrieve the

contents of an entire database. SQL injection can also be used to add, modify and delete records
in a database, affecting data integrity.
To such an extent, SQL injection can provide an attacker with unauthorized access to sensitive
data including, customer data, personally identifiable information (PII), trade secrets, intellectual
property and other sensitive information.
How SQL Injection works
In order to run malicious SQL queries against a database server, an attacker must first find an
input within the web application that is included inside of an SQL query.
In order for an SQL injection attack to take place, the vulnerable website needs to directly
include user input within an SQL statement. An attacker can then insert a payload that will be
included as part of the SQL query and run against the database server.