Distributed Denial of Service — flooding a target from many sources to exhaust capacity.
A DDoS floods a target from many sources (usually a botnet) so legitimate users can’t get through — an availability attack. The three layers each need different defenses: volumetric attacks (raw bandwidth, amplification) are absorbed by cloud scrubbing and anycast; protocol attacks (SYN floods) by stateful filtering and SYN cookies; application-layer attacks (slow, low-volume HTTP) by rate limiting and WAF rules. Over-provisioning buys headroom but isn’t a strategy on its own.
Inserting malicious input that the system mistakenly interprets as code or commands.
Injection happens when untrusted input is interpreted as code or commands — SQL injection (database), command injection (OS shell), and LDAP injection are the classic forms. The root cause is mixing data with code; the fix is to separate them with parameterized queries / prepared statements, plus input validation and least-privilege service accounts as defense-in-depth. Injection topped the OWASP Top 10 for years (No. 1 on the 2010, 2013, and 2017 lists) and still makes the 2025 list at A05 because it’s both common and high-impact.
Cross-Site Scripting — injecting client-side script into web pages viewed by other users.
XSS injects attacker-controlled script into a web page that other users’ browsers then execute, enabling session-cookie theft, keylogging, and page defacement. Three variants: stored (persisted on the server, hits every viewer), reflected (bounced off a crafted link), and DOM-based (entirely client-side). Defenses are output encoding/escaping for the context, input validation, and a Content Security Policy; modern frameworks auto-escape by default, but unsafe sinks like innerHTML reopen the hole.
Cross-Site Request Forgery — tricking a logged-in user's browser into making unwanted requests.
CSRF tricks a victim’s already-authenticated browser into submitting a request the attacker crafted — transferring funds, changing an email — riding the user’s session cookie without ever stealing the credentials. Defenses are anti-CSRF tokens (a secret value the attacker can’t predict) and SameSite cookies (so the session cookie isn’t sent on cross-site requests). Contrast with XSS, which runs attacker script in the page; CSRF abuses the trust the server places in the user’s session.
Code or technique that takes advantage of a specific vulnerability to achieve an attacker goal.
An exploit is the concrete code or technique that turns a vulnerability into an actual compromise — the weaponization step. The risk equation is threat actor + vulnerability + exploit = active attack; remove any one and there’s no incident. Public exploit availability (proof-of-concept code, Metasploit modules) sharply raises urgency, feeding the CVSS Temporal metric group (renamed the “Threat” group in CVSS 4.0) and threat-intel feeds like CISA KEV that flag what’s being exploited in the wild.
A vulnerability unknown to the vendor — and therefore unpatched — at the time of exploitation.
A zero-day is a vulnerability the vendor doesn’t yet know about — so there’s no patch and signature-based tools have nothing to match — making it especially valuable to attackers and to the exploit market. Since you can’t patch what isn’t known, defense leans on compensating controls: network segmentation, least privilege, behavior-based EDR, and virtual patching at a WAF/IPS. The moment a zero-day is disclosed, a race begins between defenders deploying the fix and attackers exploiting the window.
Spoofing is falsifying an identity to impersonate a trusted source — email sender, IP, MAC, ARP, DNS, or caller ID. Different spoofing types have different countermeasures: SPF, DKIM, and DMARC authenticate email senders; DNSSEC signs DNS records; dynamic ARP inspection blocks ARP spoofing. Spoofing is rarely the end goal — it’s typically the opening move that enables phishing, MITM, or session hijacking.
Man-in-the-Middle — an attacker secretly relaying and possibly altering communication between two parties.
In a man-in-the-middle (MITM) attack, the attacker secretly sits between two parties, relaying and possibly altering traffic while each side believes it’s talking directly to the other. Common setups use ARP poisoning, rogue Wi-Fi access points, or DNS spoofing to get into the path. Properly validated TLS — and certificate pinning for high-value apps — defeats most MITM attempts; “on-path attack” is the current preferred term for the same concept.
Trying every possible value (passwords, keys) until one succeeds.
A brute-force attack simply tries every possibility until one works; a dictionary attack narrows that to likely words, and credential stuffing reuses username/password pairs leaked from other breaches (devastating against password reuse). Defenses stack: account lockout and rate limiting slow online guessing, strong/long passwords and slow hashing (bcrypt/Argon2) blunt offline cracking, and MFA makes a guessed password insufficient on its own.
The portion of an exploit or malware that performs the attacker's intended action.
The payload is the part of malware or an exploit that performs the attacker’s actual goal — distinct from the delivery and exploitation mechanism that gets it running. The same vulnerability can deliver wildly different payloads: a reverse shell, ransomware, an info-stealer, or a cryptominer. Exploit frameworks like Metasploit make this modular by design, decoupling the exploit from a menu of interchangeable payloads.
Software or hardware that records keystrokes to capture credentials and sensitive input.
A keylogger records keystrokes to harvest passwords, card numbers, and messages — a high-impact subtype of spyware. Software keyloggers are caught by anti-malware and EDR, but hardware keyloggers (a small device inline between keyboard and PC, or inside it) capture input before any software sees it and evade endpoint scanning entirely. MFA limits the damage of a stolen password, and on-screen keyboards or password-manager autofill sidestep simple keystroke capture.
A hidden method of bypassing normal authentication to maintain access.
A backdoor bypasses normal authentication to give persistent, hidden access — left by malware, by an attacker after compromise, or occasionally by a developer. Hunt for the signs: unexpected listening ports, new local accounts, and scheduled tasks pointing to odd paths. The most dangerous variety is the supply-chain backdoor (e.g., the XZ Utils implant), which reaches victims through trusted, signed software updates.
More Threats, Vulnerabilities, and Mitigations study sets