In this video, we cover application based cyber attack as covered on the information systems and controls ISC CPA exam.
Start your free trial: [ Ссылка ]

Application-based attacks are malicious activities that specifically target software or applications, such as websites and databases. These attacks aim to gain unauthorized access or disrupt the normal operations of the application. Among the various types of application-based attacks, SQL Injection is one of the most prevalent and dangerous.

SQL Injection is a technique where attackers exploit vulnerabilities in an application's database interaction. Instead of accessing a company's database directly, which is often well-protected, attackers target the web server that interfaces with the database. They inject malicious SQL commands into the existing SQL queries that the application uses to communicate with its database. This is done through the input fields on a website, such as login forms, search boxes, or URL query parameters.

This attack works because web applications often take user input and directly include it in SQL queries without proper validation or sanitization. By carefully crafting the input, an attacker can manipulate these queries to execute unintended SQL commands. These commands could do anything from unauthorized data retrieval, deletion, to bypassing login authentication.


Cross-Site Scripting (XSS) is a cybersecurity vulnerability that, like SQL Injection, involves injecting malicious code into websites. However, while SQL Injection targets a website's database, XSS attacks specifically aim at the website's users. This type of attack occurs when a website allows user-generated content to be included without proper sanitization, thereby enabling attackers to inject malicious scripts into web pages viewed by other users.

In an XSS attack, the attacker's goal is to execute malicious scripts in the browser of anyone who visits the compromised web page. These scripts can perform a wide range of actions, from stealing session cookies, which could allow attackers to impersonate the victim and gain unauthorized access to their accounts, to redirecting the victim to phishing sites or other malicious web pages.



#cpaexaminindia #cpaexam #cpareviewcourse

свернуть