What attacks are typical for L7?

Layer 7 (Application Layer) attacks target applications and services, not the network itself or its transport protocols.

In simple terms: they attack what the user directly works with, websites, APIs, login forms, email.

---

#Why L7 is the most vulnerable layer

• applications are complex and often contain bugs;
• the traffic looks legitimate (like ordinary requests);
• attacks are hard to distinguish from the actions of real users.

That is why L7 is the most frequently attacked OSI layer.

---

#Main L7 attacks

#1. SQL Injection

The idea: malicious SQL code is injected into the input data.

What happens:

• data leaks from the database;
• authentication bypass;
• data deletion or modification.

A classic attack on web applications.

---

#2. XSS (Cross-Site Scripting)

The idea: injecting malicious JavaScript code into a page.

What happens:

• cookie theft;
• session hijacking;
• page content spoofing.

Dangerous for the site's users.

---

#3. CSRF (Cross-Site Request Forgery)

The idea: the user is made to perform an action without their knowledge.

Examples:

• transferring money;
• changing a password;
• changing account settings.

Exploits the site's trust in the user.

---

#4. HTTP Flood (L7 DDoS)

The idea: mass HTTP requests that look like normal traffic.

What happens:

• the application becomes overloaded;
• the service becomes unavailable.

Unlike L3/L4 DDoS, it is very hard to filter.

---

#5. Brute Force / Credential Stuffing

The idea: mass login attempts against accounts.

What happens:

• password guessing;
• account compromise.

Often aimed at login forms and APIs.

---

#6. File Inclusion (LFI / RFI)

The idea: including local or remote files through application vulnerabilities.

What happens:

• reading configuration files;
• code execution;
• full server takeover.

---

#7. Command Injection

The idea: executing system commands through a vulnerable application.

What happens:

• remote control of the server;
• compromise of the entire system.

---

#What L7 attacks usually violate

• Confidentiality - data leaks;
• Integrity - data spoofing or modification;
• Availability - denial of service (HTTP Flood).

---

#How to defend against L7 attacks

Main measures:

• WAF (Web Application Firewall);
• input validation;
• secure coding;
• rate limiting;
• MFA and login form protection;
• updating applications.

An L3/L4 firewall is not enough, applications themselves need protection.