Simple explanation
This lesson pairs specific attack/vulnerability types with the technical understanding needed to actually defend against each of them — the practical, hands-on side of vulnerability management.
Technical explanation
Attack types to recognize:
- Injection — malicious input alters intended command/query logic (SQL injection being the classic example).
- Buffer overflow — writing more data than allocated memory can hold, corrupting adjacent memory.
- Privilege escalation — gaining higher access than originally granted.
- LFI/RFI (Local/Remote File Inclusion) — tricking an application into including and executing a file it shouldn't, either from the local system (LFI) or a remote, attacker-controlled location (RFI).
- Directory traversal — accessing files outside an intended directory using path manipulation (
../../etc/passwdstyle). - Cross-Site Scripting (XSS) — injecting malicious script that executes in another user's browser session.
- Race condition — exploiting the timing gap between checking a condition and acting on it.
- Malicious update — a compromised legitimate update mechanism delivering bad code.
- Memory injection — inserting code directly into a running process's memory.
- Deprecated/unsupported third-party libraries — using outdated dependencies with known, unpatched vulnerabilities.
- VM escape — breaking out of a virtual machine's isolation to affect the host or other VMs.
Vulnerability categories: OS-based, network-based, TOCTOU (Time-Of-Check-Time-Of-Use — the formal name for the race condition category), web-based (SQL injection, CSRF — Cross-Site Request Forgery), and zero-day.
Mitigating these generally comes back to the same toolkit as Security+ Domain 2: input validation, least privilege, patching, segmentation, and secure coding practices — but a CySA+ analyst needs to recognize the SPECIFIC attack pattern in log/traffic data to know which mitigation actually applies.
Synonyms / related terms
| Term | Means | |---|---| | LFI/RFI | Local/Remote File Inclusion | | TOCTOU | Time-Of-Check-Time-Of-Use | | CSRF | Cross-Site Request Forgery |
Concept Check
"A web application log shows a request for /download?file=../../../../etc/passwd." This is directory traversal, not LFI/RFI — the distinguishing feature is the ../ path manipulation attempting to escape the intended directory, rather than the inclusion of a separate file reference (which would look more like ?page=malicious.php or a remote URL).
Interview-style Q&A
Q: What's the practical difference between LFI and RFI? A: "LFI includes a file that already exists somewhere on the local server — the attacker is abusing the application's own file inclusion logic to reach something it shouldn't, like a log file that can be poisoned with attacker-controlled content. RFI goes further, pointing the inclusion at a completely remote, attacker-hosted file — meaning the attacker doesn't need anything already on the server at all, they bring their own malicious code entirely."
Memory trick
"Inject, Overflow, Escalate, Include, Traverse, Script" — six attack verbs, in a memorable order, covering the core attack types this lesson requires you to recognize by behavior, not just by name.