There are many ways hackers can target Web applications (websites that allow you to interact directly with software using the browser), to steal confidential data or introduce malicious codes or hijack your computer. These attacks exploit vulnerabilities within components like web applications, content-management systems and web servers.
Web app attacks constitute the majority of security threats. In the last decade, attackers have improved their ability to identify and exploiting vulnerabilities which impact the perimeter defenses of applications. Attackers have been able to bypass the most common defenses by using techniques like phishing engineering and botnets.
A phishing attack consists of fooling victims into clicking an email link that contains malware. The malware is downloaded to the computer, which enables attackers to steal devices or systems for additional reasons. Botnets are a collection of infected and compromised connected devices, that attackers use to launch DDoS attacks, spread malware, continue fraud through ads, and more.
Directory (or path) traversal attacks rely on movement patterns to gain access to files on the website, its configuration files and databases. Protecting against this type of attack requires the proper sanitization of inputs.
SQL injection attacks are designed at the database that holds crucial information about websites and services by injecting malicious code that allow it to override and reveal details that it would never normally reveal. Attackers can then execute commands to dump databases, and many other things.
Cross-site scripting attacks (or XSS), insert malicious code on a trusted site to hijack the browsers of users. This allows attackers to steal session cookies and private information, impersonate users, manipulate the content, and so on.
http://neoerudition.net/board-software-to-achieve-maximum-results