RANGER GAMEZ

CompTIA Security+ (SY0-701) · chapter 8 of 27

Month 2: The weak spots report

In this chapter Objectives 2.3

  1. Application vulnerabilities
  2. OS-based and web-based vulnerabilities
  3. Hardware and virtualization
  4. Cloud, supply chain, crypto, misconfiguration
  5. Mobile devices and zero-days
  6. Practice questions
  7. Chapter recap

Objective 2.3

Application vulnerabilities

Memory injection and buffer overflow

Memory injection puts malicious code into the memory space of a running, trusted process (for example DLL injection on Windows), so it runs with that process's rights and hides inside it. A buffer overflow happens when a program writes more data into a memory buffer than it was built to hold, overwriting nearby memory; a crafted overflow can crash the app or let the attacker run their own code.

Memory drawn as a row of boxes: an 8-byte input buffer followed by the saved return address that tells the program where to go next. A normal 5-letter input fits inside the buffer. A long input of many A characters runs past the end of the buffer and overwrites the return address, which can crash the program or let a crafted input run the attacker's code. Fix: bounds checking and input validation, plus ASLR and DEP.
Too much input spills past the buffer and overwrites what comes next.

Exam tip Clue for overflow: "input longer than expected", a crash, or a long string of A's or NOP-like bytes. Fix: input validation and bounds checking, plus memory protections like ASLR and DEP.

Race conditions: TOC/TOU

A race condition is a flaw where the result depends on the timing of events. The classic is time-of-check to time-of-use (TOCTOU): the program checks something at time-of-check (TOC) and acts on it later at time-of-use (TOU); an attacker changes the thing in between. Example: an app checks a gift card has $50, a second request spends it in the gap, then the first request spends it again.

A timeline of a time-of-check to time-of-use race. At the time of check, the app confirms the gift card has 50 dollars. In the gap before the time of use, a second request spends the 50 dollars. At the time of use, the first request spends it again, so the money is spent twice. The fix is to make check and use one atomic step, or lock the card in between.
TOCTOU: something changes between the check and the use.

Exam tip Fix: make check-and-use one atomic step, or lock the resource between them.

Malicious update

A malicious update is an update that carries malware, because an attacker compromised the vendor's build or update server, or tricked the app into downloading from a fake source. Users trust it because it looks like a normal update, often digitally signed by the real vendor's build system.

Exam tip Defense: verify signatures and hashes, test updates before wide rollout, and watch new behavior after updates.

Objective 2.3

OS-based and web-based vulnerabilities

Operating system (OS)-based

Operating systems are huge and complex, so OS-based vulnerabilities keep appearing: privilege escalation bugs, remote code execution in network services, kernel flaws. Vendors fix them in regular patch cycles (many monthly) plus emergency fixes. The defense is fast, tested patching and removing features you don't use.

Exam tip Patch Tuesday-style cycles mean exploits often appear right after patches are published, as attackers study the fix.

SQL injection (SQLi)

Structured Query Language injection (SQLi) happens when an app puts user input directly into a database query. Input like ' OR 1=1-- changes the query's logic, letting the attacker read, change or delete data. The fixes are parameterized queries (prepared statements), input validation and least-privilege database accounts.

SELECT * FROM users WHERE name='' OR 1=1--'
-- 1=1 is always true;
-- the rest is commented out
How SQL injection works. The app builds a query by pasting the user's input into it: SELECT * FROM users WHERE name equals the input. A normal user types rosa. An attacker types a quote, OR 1=1, and two dashes. The quote closes the string, OR 1=1 is always true, and the dashes comment out the rest, so the query returns every user. The fix: parameterized queries, input validation and least-privilege database accounts.
Input that closes the quote rewrites the query; parameterized queries stop it.

Exam tip Clues: quote marks, OR 1=1, UNION SELECT, -- or ; in a log. Answer: parameterized queries.

Cross-site scripting (XSS)

Cross-site scripting (XSS) gets a site to send attacker JavaScript to other users' browsers, where it runs as if the trusted site sent it (stealing session cookies, rewriting the page). Reflected (non-persistent) XSS bounces script in a crafted link off the server; stored (persistent) XSS saves it in the site, such as a product review, to hit everyone who views it.

Stored cross-site scripting in four steps. 1: an attacker posts a product review on the shop that hides a script. 2: the site stores the review in its database. 3: a customer opens the product page and the site sends them the review, script included. 4: the customer's browser runs the script as if the shop sent it, and it sends the customer's session cookie to the attacker. Fix: input validation and output encoding.
XSS makes a trusted site deliver the attacker's script to other users' browsers.

Exam tip XSS targets the users of a site through their browsers. SQLi targets the site's database. Fix XSS with input validation and output encoding.

Check yourself 1A product review on the shop contains <script> code that sends each viewer's session cookie to an outside server. What vulnerability is this?

  1. SQL injection
  2. Server-side request forgery
  3. Stored cross-site scripting
  4. Memory injection
Show the answer

Answer: C. Stored cross-site scripting

Script saved in the site and run in every viewer's browser is stored XSS. SQL injection attacks the database through queries, not other users' browsers.

Objective 2.3

Hardware and virtualization

Firmware, end-of-life, legacy

Firmware is the low-level software in hardware (BIOS/UEFI, routers, cameras, drives). Its flaws are hard to see and often never patched, because updates are manual. End-of-life (EOL) means the maker has stopped selling it; patches may continue for a while, but once support ends too (end of service life) new flaws stay open. Legacy systems are old platforms still in use because something depends on them, often running unsupported software and hard to secure.

Exam tip If a device can't be patched, think compensating controls: isolate it, monitor it, plan its replacement.

VM escape and resource reuse

Virtual machine (VM) escape is breaking out of a guest VM to reach the hypervisor or other VMs on the same host, the most serious virtualization flaw because one compromised guest can own the whole host. Resource reuse is when memory, storage or other resources given back by one VM are handed to another without being cleared, so data can leak between VMs.

Exam tip Defense: patch the hypervisor quickly, and separate sensitive workloads onto different hosts.

Objective 2.3

Cloud, supply chain, crypto, misconfiguration

Cloud-specific and supply chain

Cloud-specific vulnerabilities come with cloud services: publicly exposed storage buckets, weak identity and access settings, insecure APIs, unprotected management consoles, and confusion over the shared responsibility model. Supply chain vulnerabilities come from your providers: a service provider with weak security and access to you, a hardware provider shipping counterfeit or tampered parts, a software provider whose code or update system is compromised.

Exam tip Most cloud breaches come from customer misconfiguration, not from the cloud provider being hacked.

Cryptographic and misconfiguration

Cryptographic vulnerabilities: weak or outdated algorithms (MD5, SHA-1, DES), short keys, poor key management (keys hard-coded in code, never rotated), bad random numbers or flawed implementations. Misconfiguration: insecure settings such as open file permissions, default accounts left enabled, unneeded services and ports on, debug mode on in production, cloud storage set to public.

Exam tip Misconfiguration is one of the most common real-world causes of breaches; configuration baselines and automated checks catch it.

Objective 2.3

Mobile devices and zero-days

Side loading and jailbreaking

Side loading is installing apps from outside the official app store (for example an APK from a website), which skips the store's security review. Jailbreaking (iOS) or rooting (Android) removes the operating system's built-in restrictions to gain full control, which also disables protections and blocks updates or MDM controls.

Exam tip MDM can detect jailbroken or rooted devices and block them from company data.

Zero-day

A zero-day vulnerability is one the vendor doesn't know about yet or hasn't patched, so defenders have had "zero days" to fix it. A zero-day attack exploits such an unpatched flaw. Signature-based tools can't recognize it, so defense relies on layered controls, behavior-based detection, least privilege and quick response.

Exam tip Zero-day = no patch exists yet. A known, unpatched vulnerability with a patch available is NOT a zero-day.

Check yourself 2A warehouse worker installs a barcode app on a company phone from a file emailed by a friend, not from the official store. Which vulnerability does this create?

  1. Jailbreaking
  2. Side loading
  3. Resource reuse
  4. Zero-day
Show the answer

Answer: B. Side loading

Installing an app from outside the official store is side loading, which skips the store's security checks. Jailbreaking removes the OS restrictions, which didn't happen here.

Practice questions

Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.

Question 1Day 0: a vendor publishes a patch and a CVE for its VPN appliance. Day 9: CISA adds the CVE to its Known Exploited Vulnerabilities catalog. Day 21: Kibble & Co.'s still-unpatched appliance is breached through that flaw. How should the vulnerability exploited on day 21 be classified?

  1. A misconfiguration, because the appliance was online
  2. A zero-day, because Kibble & Co. had not heard of it
  3. A zero-day, because it was exploited in the wild
  4. A known vulnerability left unpatched, not a zero-day
Show the answer

Answer: D. A known vulnerability left unpatched, not a zero-day

A zero-day is a flaw exploited before the vendor knows of it or has a fix. A patch existed 21 days before this breach, so it was a known, unpatched vulnerability; active exploitation does not make a flaw a zero-day.

Question 2A TLS scan of Kibble & Co.'s payment API returned the exhibit. Which TWO findings are cryptographic vulnerabilities that should be fixed? (Choose two.)

  1. HSTS max-age is set to one year
  2. The certificate uses a 2048-bit RSA key
  3. ECDHE key exchange with AES-256-GCM is offered
  4. TLS 1.0 is still enabled
  5. An RC4 cipher suite is offered
Show the answer

Answers: D. TLS 1.0 is still enabled, E. An RC4 cipher suite is offered

TLS 1.0 is deprecated (RFC 8996) and RC4 is a broken stream cipher banned from TLS (RFC 7465). A 2048-bit RSA key with SHA-256, ECDHE with AES-GCM and a one-year HSTS policy are current, acceptable settings.

Question 3An app scan reports that the shop's search page copies the q parameter into the results page without encoding it, and nothing is saved on the server. An attacker emails customers a shop link whose q parameter contains script. Which vulnerability is this, and whose browser runs the script?

  1. Reflected XSS; each customer who clicks the link
  2. Stored XSS; every visitor to the search page
  3. CSRF; the shop's web server, on the customer's behalf
  4. SQL injection; the shop's database server
Show the answer

Answer: A. Reflected XSS; each customer who clicks the link

The input is echoed straight back in the response and never stored, so only someone who opens the crafted link runs the script: reflected cross-site scripting. Stored XSS needs the script saved on the site, where it hits every visitor.

Question 4Kibble & Co. patches promptly and its own systems were never breached. Its payroll SaaS provider then announces that attackers stole customer databases from the provider's environment, including Kibble & Co. employees' bank details. Which vulnerability type BEST describes Kibble & Co.'s exposure?

  1. Misconfiguration
  2. Service provider supply chain
  3. Zero-day
  4. Software supply chain
Show the answer

Answer: B. Service provider supply chain

The weakness was in a third party that processes Kibble & Co.'s data, so the exposure came through its service provider. A software supply chain issue would be a flaw in code or components the company itself runs.

Question 5Customer invoices stored in a cloud bucket turn up in search engine results. The bucket has encryption at rest enabled, versioning on, access logging off, a WRITE grant for the svc-billing account and a READ grant for AllUsers. Which setting caused the exposure, and what type of vulnerability is it?

  1. The svc-billing WRITE grant; privilege escalation
  2. Disabled access logging; missing logs
  3. The AllUsers READ grant; a misconfiguration
  4. Provider-managed encryption; a cryptographic flaw
Show the answer

Answer: C. The AllUsers READ grant; a misconfiguration

A READ grant to AllUsers makes every object readable by anyone on the internet, a cloud misconfiguration. Encryption at rest does not stop reads the service itself authorizes, and logging only records access.

Practice it in Ranger's Cyber PatrolThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.