Suggest an edit

Improve this article

Refine the answer for “What attacks are typical for L7?”. Your changes go to moderation before they’re published.

Approval required

Content

What you’re changing

Title (EN)

Short answer (EN)

Shown above the full answer for quick recall.

Answer (EN)

**Layer 7 (Application Layer) attacks** target **applications and services**, not the network itself or its transport protocols.

In simple terms:
*they attack what the user directly works with, websites, APIs, login forms, email.*

---

## Why L7 is the most vulnerable layer

- applications are complex and often contain bugs;
- the traffic looks **legitimate** (like ordinary requests);
- attacks are hard to distinguish from the actions of real users.

That is why **L7 is the most frequently attacked OSI layer**.

---

## Main L7 attacks

### 1. SQL Injection

**The idea:**
malicious SQL code is injected into the input data.

**What happens:**

- data leaks from the database;
- authentication bypass;
- data deletion or modification.

A classic attack on web applications.

---

### 2. XSS (Cross-Site Scripting)

**The idea:**
injecting malicious JavaScript code into a page.

**What happens:**

- cookie theft;
- session hijacking;
- page content spoofing.

Dangerous for the site's users.

---

### 3. CSRF (Cross-Site Request Forgery)

**The idea:**
the user is made to perform an action **without their knowledge**.

**Examples:**

- transferring money;
- changing a password;
- changing account settings.

Exploits the site's trust in the user.

---

### 4. HTTP Flood (L7 DDoS)

**The idea:**
mass HTTP requests that look like normal traffic.

**What happens:**

- the application becomes overloaded;
- the service becomes unavailable.

Unlike L3/L4 DDoS, it is **very hard to filter**.

---

### 5. Brute Force / Credential Stuffing

**The idea:**
mass login attempts against accounts.

**What happens:**

- password guessing;
- account compromise.

Often aimed at login forms and APIs.

---

### 6. File Inclusion (LFI / RFI)

**The idea:**
including local or remote files through application vulnerabilities.

**What happens:**

- reading configuration files;
- code execution;
- full server takeover.

---

### 7. Command Injection

**The idea:**
executing system commands through a vulnerable application.

**What happens:**

- remote control of the server;
- compromise of the entire system.

---

## What L7 attacks usually violate

- **Confidentiality** - data leaks;
- **Integrity** - data spoofing or modification;
- **Availability** - denial of service (HTTP Flood).

---

## How to defend against L7 attacks

Main measures:

- WAF (Web Application Firewall);
- input validation;
- secure coding;
- rate limiting;
- MFA and login form protection;
- updating applications.

**An L3/L4 firewall is not enough, applications themselves need protection.**

Markdown · drag & drop images · ⌘B / ⌘I shortcuts391 words

For the reviewer

Note to the moderator (optional)

Visible only to the moderator. Helps review go faster.