Web, Hardware, Virtualization, and Cloud Vulnerabilities
Unit 4: Vulnerabilities. Lesson 14 of 54 in SecPlus Academy.
Four more families, each with a signature the exam expects you to spot in a sentence.
Web application vulnerabilities
- SQL injection: user input is pasted into a database query. Entering
' OR 1=1 --in a login field turns the query into "where the password is anything." Attackers read, change, or delete data. Defense: parameterized queries and input validation. - Cross-site scripting (XSS): an attacker stores or reflects script in a web page, and other users' browsers run it, stealing session cookies or defacing content. Defense: output encoding, input validation, content security policy.
SQL injection is abbreviated SQLi on the exam.
Hardware vulnerabilities
- Firmware: the code inside devices can carry flaws that survive reinstalling the operating system. Patch firmware too.
- End-of-life: the vendor no longer supports the product. Legacy: old technology still in use because something depends on it. Both keep known flaws open forever; isolate, monitor, and plan replacement.
Virtualization vulnerabilities
- VM escape: code inside a guest virtual machine breaks out and runs on the hypervisor or host, reaching every other VM. The most serious virtualization flaw. Defense: patch the hypervisor, limit guest tools.
- Resource reuse: memory or storage freed by one VM is handed to another without being wiped, leaking data between tenants. Defense: providers must zero resources before reuse.
Cloud-specific vulnerabilities
Misconfigured storage buckets left public, overly permissive identity policies, exposed management APIs, and misunderstandings of the shared responsibility model: the provider secures the cloud, the customer secures what they put in it. Most cloud breaches are customer misconfiguration.
Reading the scenario
- "A single quote in the search box produced a database error": SQL injection.
- "Users see a pop-up that steals their session cookie": XSS.
- "Attack from one tenant's VM affected other tenants on the host": VM escape.
- "Data from a previous customer appeared in newly allocated storage": resource reuse.
- "Backups were readable by anyone on the internet": cloud misconfiguration.
Web, Hardware, Virtualization, and Cloud Vulnerabilities, explained slowly
Four more families
Web, hardware, virtualization, and cloud vulnerabilities each have one or two members the exam wants you to spot instantly.
Web applications
SQL injection. A web form takes what you type and pastes it into a database query.
The code builds: SELECT * FROM users WHERE user='[input]' AND pass='[input]' Attacker types: ' OR 1=1 -- The query becomes: SELECT * FROM users WHERE user='' OR 1=1 --' AND pass=''
"1=1" is always true and "--" comments out the rest, so the query returns every user and the attacker is logged in as the first one, often the administrator. Variations dump whole tables or delete them. The tell in a question: a single quote in a form field produces a database error, or unexpected data appears. Defense: parameterized queries (the input is passed as data, never as part of the command) and input validation.
Cross-site scripting (XSS). The attacker gets script into a page that other users load: a comment field, a profile name, a search result. When the victim's browser renders the page, the script runs as if the site wrote it, and it can read the victim's session cookie, change the page, or send requests as the victim. Stored XSS lives in the database; reflected XSS is in a crafted link. Defense: encode output so script is displayed as text, validate input, and set a content security policy.
The distinction: SQL injection runs on the server against the database. XSS runs in other users' browsers.
Hardware
- Firmware: the software inside a device, from a laptop's UEFI to a router's operating system. Flaws here survive reinstalling the OS, and firmware is patched far less often than software. Include it in the patch cycle and verify firmware signatures.
- End-of-life: the vendor has stopped support; no more patches ever. Legacy: old technology still in use because something depends on it. Both mean every new flaw is permanent. The answer is replace, and until then isolate and monitor as a compensating control.
Virtualization
- VM escape: code inside a guest breaks out of the virtual machine and runs on the hypervisor or host. From there it can reach every other guest on that host. This is the most serious virtualization flaw; hosting providers treat it as an emergency. Defense: patch the hypervisor promptly, minimize guest-to-host integrations, and keep sensitive workloads on dedicated hosts.
- Resource reuse: when a VM is deleted, its memory and storage are handed to the next tenant. If they are not wiped first, the new tenant can read fragments of the old tenant's data. Defense: providers must zero memory and storage before reallocation; customers should encrypt their own data so leftovers are unreadable.
Cloud-specific
Most cloud breaches are not clever. A storage bucket left publicly readable. An identity policy that grants far more than needed. A management API reachable from the internet with a weak key. Underneath these is a misunderstanding of the shared responsibility model: the provider secures the physical infrastructure and the platform; the customer secures data, identities, configuration, and access. Defense: configuration scanning, least-privilege identities, private endpoints, and knowing which side of the line each control is on.
Reading the scenario
"A single quote in the login field returned a database error" SQL injection "Users report a pop-up on the forum that sends their cookie elsewhere" XSS "The router's flaw persists after the OS is reinstalled" firmware "The imaging system runs an OS the vendor stopped supporting" end-of-life / legacy "A guest VM gained access to other customers' VMs on the host" VM escape "Newly provisioned storage contained another company's data" resource reuse "Backups were accessible to anyone with the URL" cloud misconfiguration
What to memorize
- SQL injection: ' OR 1=1, server side, parameterized queries.
- XSS: script in a page, runs in other browsers, output encoding.
- VM escape reaches the host; resource reuse leaks between tenants.
- Cloud: customer misconfiguration is the usual cause; shared responsibility.