Often, servers take the data input in the form and display it back to the user in an HTML page to confirm the input. If the user types code, such as a JavaScript program, into a form field, the server processing the form might execute the code if there aren't any input checks. Parameter tampering Parameter tampering involves manipulating URL strings to retrieve information the user shouldn't see. Most Web applications include a back-end database and the URL includes a SQL call to this database. Malicious users can manipulate the SQL code to potentially retrieve a listing of all users, passwords, credit card numbers, or any other data stored in the database.
Cookie poisoning refers to modifying the data stored in a cookie.
Web sites often store cookies on user systems that include userids, passwords, account numbers, etc. By changing these values, or poisoning the cookie, malicious users could gain access to accounts that aren't their own. Input checking Input checking involves the ability to run system commands by manipulating input in HTML forms processed by a CGI script. For example, a form that uses a CGI to mail information to another user could be manipulated through data entered in the form to mail the password file of the server to a malicious user or delete all the files on the system. A buffer overflow is a classic attack technique where a malicious user sends a large amount of data to a server to crash the system.