Question

I need help with an ethical hacking class to Describe cross-site scripting (CSS), cross-site request forgery (CSRF), buffer overflow, and structured query language (SQL) injection attacks With this

• Compare cross-site scripting (CSS) and cross-site request forgery (CSRF).
• Compare buffer overflow, and structured query language (SQL) injection attacks.
• Which attacks are used by hackers to attack database management systems.

Answer 1

Compare cross-site scripting (CSS) and cross-site request forgery (CSRF).
In cross-site scripting, the authentication session not required. It is exploited directly when the website becomes vulnerable for security breaches whereas CSRF happens in the authenticated sessions when the server trusts the browser or user.

In CSS, the server does not validate the input. The attackers send the input in any forms like request parameters, cookies, URL parameters etc.

In CSRF, with the sessions, the information can be exploited.

In CSRT, authentical tokens exploited whereas in CSS you do spoofing.

Compare buffer overflow and structured query language (SQL) injection attacks.
A buffer overflow happens when the data supplied to the data structure more than allotted. It cannot handle the data since the buffer is full, it causes a data overflow to adjacent memory locations. The main reason for the buffer overflow attack is not checking the buffer overflow. An attacker can inject the code into adjacent memory locations through the overflow.

SQL injection
In SQL injection malicious code is being injected into the database to update/retrieve the data from unauthorized access.

The main difference between SQL injection and buffer overflow is SQL injection takes the advantages of inserting malicious code into database whereas buffer overflow uses a malicious code in the front end to get access.

Which attacks are used by hackers to attack database management systems?
The main attack that attackers use for a database is SQL injection. In SQL injection takes advantage of inserting malicious code into a database. The main reason for this attack is lack of validation is being performed in the front-end as well as in the back-end.

Privilege Escalation
In this attack, with the provided privileges, additional privileges are granted based on the loopholes exist in the database.

Encryption
Storing the passwords and other confidential information directly in the database without crypto techniques and making use of own user-defined mechanisms.