What is a web application attack?¶
The practical answer¶
A web application attack is malicious or unauthorised activity directed at a website, web service, API or application delivered through web technologies.
The key evidential caution¶
The dangerous assumption is that every unusual web request proves an attack succeeded.
It may not.
Web applications receive many malformed, automated and exploratory requests.
An attack may attempt to:
Key points¶
- bypass authentication
- read or alter data
- execute commands
- upload files
- take over accounts
- abuse business logic
- disrupt the service
- gain access to connected systems
What investigators should establish¶
Investigators should establish:
Key points¶
- which application or endpoint was targeted
- what request was sent
- whether authentication was involved
- what response was returned
- whether server-side activity followed
- what data or system effect occurred
Relevant evidence¶
Relevant evidence may exist in web-server logs, application logs, reverse-proxy records, database logs, cloud audit events, endpoint telemetry and provider records.
Evidential limits¶
Do not assume that a suspicious URL, parameter or payload proves successful exploitation.
A request may have been blocked, rejected, malformed or sent to a non-vulnerable version.
Likewise, the absence of a visible error does not prove success or failure.
A web application may sit behind several services, including content-delivery networks, load balancers, gateways and cloud platforms. The first visible IP address may not identify the true source or target.
Where the application is distributed across several services, identify which component handled the request and which component produced the effect. A reverse proxy may record the source, an application server may record the function, and a database or cloud service may record the resulting action. Correlating those layers prevents one log from being treated as the whole incident.
Operational takeaway¶
Separate malicious request, application response, server-side effect and resulting access, and prove each stage before describing a web application as compromised.