Use this as a quick reference for privilege escalation, weak access controls, and the four application attack mechanisms.
🧭 Plot Summary
So far, most vulnerabilities you've studied lived at the device or network level. This activity moves up a layer — into the applications and servers that actually run the software people use every day, where a single unchecked input field can undo everything else you've secured.
SQL Injection
Malicious SQL smuggled through an input field
Cross-Site Scripting
Malicious code that runs in someone else's browser
Buffer Overflow
Input that spills past its allotted memory
Directory Traversal
../ characters used to escape the intended folder
You'll also see how privilege escalation and weak access controls turn one compromised regular account into full control of a system — no exotic attack required, just permissions that were never locked down properly.
What you will do in this lesson
Learn how privilege escalation and weak access controls turn a compromised regular account into a serious breach.
Study SQL injection — the classic example of what happens when user input isn't validated.
Learn cross-site scripting (XSS) and the difference between reflected and stored attacks.
Understand buffer overflow at the memory level — what actually happens when input exceeds its allotted space.
Learn directory traversal, using ../ to escape a web server's intended file directory.
Why it matters
This is the single densest activity in application security so far — five distinct, heavily-tested mechanisms. Knowing the name of each attack isn't enough; the exam rewards knowing exactly how each one works.
✅ Self-Check Before You Roll On
Check off each item as you get there. These are not grades — they are your own signal.
