Application Protection Overview

SQL injection

SQL injection is an attack technology. Attackers exploit the vulnerabilities of dynamic SQL query in web applications to insert malicious code into user input fields and trick the database into executing SQL commands to steal, tamper with, or damage sensitive data, or run dangerous system-level commands on the database server. Most websites and web applications need to use SQL databases. Therefore, SQL injection attacks become one of the oldest and most widely launched network attacks.

SQLI

Detect and defend against SQL injection attacks, and check web applications for related vulnerabilities.

OS command injection

OS command injection is a web program vulnerability that is usually found in applications that require user input. If there is no effective filtering and verification mechanism for user input, this vulnerability may be exploited. It allows attackers to execute arbitrary OS commands on the server where an application is running.

CMDI

Detect and defend against remote OS command injection attacks and check web applications for related vulnerabilities.

XSS

Cross-site scripting (XSS) is a typical web program vulnerability exploit attack. Attackers can inject executable malicious scripts into websites or web applications where web programs do not check user input. When users access web pages, the malicious scripts are executed to steal users' personal data, display advertisements, or even tamper with web page content.

XSS

Detect and defend against stored XSS attacks.

Log4j RCE vulnerability

Log4j RCE is a major security vulnerability in Apache Log4j 2.x. This vulnerability allows attackers to inject and execute remote code through Java Naming and Directory Interface (JNDI).

Log4jRCE

Detect and defend against remote code execution and intercept attacks.

Web shell upload

Uploading web shells is a network attack method. Attackers upload malicious code such as web shells to a server through vulnerability exploit or other methods to obtain the control permission for the server.

WebShellUpload

Detect and defend against attacks that upload dangerous files, change file names, or change file name extension types; and check web applications for related vulnerabilities.

Memory injection

Memory injection is an advanced network attack technology. Attackers inject malicious code into the memory, bypassing the traditional security defense mechanism and controlling the target system.

FilelessWebshell

Detect and defend against memory injection attacks.

XXE

XXE refers to the XML External Entity Injection vulnerability. If external entity reference is not disabled when an application parses XML files, attackers can construct malicious XML content to read arbitrary files and execute system commands.

XXE

Detect and defend against XXE injection attacks, and check web applications for related vulnerabilities.

Deserialization input

Deserialization is a process of restoring serialized data (such as strings and byte streams) to original objects. In the process of generating a deserialized object, an attacker may construct specific serialized data input to control the generated object and launch attacks.

UntrustedDeserialization

Detect deserialization attacks that exploit unsafe classes.

File directory traversal

File directory traversal means that an attacker accesses or reads any file or folder on a server by modifying URLs or using special characters to bypass the security check of an application.

FileDirAccess

Check whether sensitive directories or files are accessed.

Struts2 OGNL

Struts2 OGNL refers to the Object-Graph Navigation Language (OGNL) in Struts2 in the Java web framework. If OGNL expressions are externally controllable, attackers can construct malicious OGNL expressions to make programs perform malicious operations.

Struts2OGNL

Detect OGNL code execution.

Command execution using JSP

Java Server Pages (JSP) is a technology for developing dynamic web pages. Attackers may exploit JSP security vulnerabilities to execute invalid OS commands, causing data leakage and service interruption.

SuspiciousBehavior

Detect command execution using JSP.

File deletion using JSP

Attackers may exploit JSP security vulnerabilities to delete files from a server.

SuspiciousBehavior

Detect file deletion using JSP.

Database connection exception

Database connection exceptions include but are not limited to network exceptions, configuration errors, and permission exceptions. These exceptions may indicate that applications are being attacked.

SuspiciousException

Detect authentication and communication exceptions thrown by database connections.

0-day vulnerability

0-day vulnerabilities, also called zero-day attacks, usually refers to security vulnerabilities that have not been patched. If such vulnerabilities are detected, hackers can exploit these vulnerabilities to launch zero-day attacks.

• zeroDay
• zeroDayDetect

• Check whether the stack hash of a command is in the whitelist of the web application.
• Detect and defend against expression injection attacks, and check web applications for related vulnerabilities.

SecurityManager permission exception

SecurityManager is a Java security manager class that manages and controls the security of applications. When the SecurityManager detects that the code performs an operation that is not allowed, an exception is thrown.

SuspiciousException

Detect exceptions thrown by SecurityManager.

JNDI injection

When an application uses the lookup method of JNDI, if the queried URL can be controlled externally, an attacker can construct a malicious URL to make the server load malicious payloads and implement remote code execution.

JNDI

Detect and defend against JNDI injection attacks, and check web applications for related vulnerabilities.

Expression injection

Expression Language (EL) injection. If EL expressions are externally controllable, attackers can construct malicious EL expressions to make programs perform malicious operations.

ExpressionInject

Detect and defend against expression injection attacks, and check web applications for related vulnerabilities.

Enabling Application Protection

Enable application protection for a server to assess application security in real time.

Viewing Application Protection Events

Analyze triggered events, harden application protection measures, and improve application security.