Know the attack.
Defend with context.
A living, defender-first encyclopedia of denial-of-service, malware, identity, application, network, cloud, supply-chain and emerging attacks—organized by the layer and system each technique affects.
Version 1.1 · Reviewed August 15, 2026 · Maintained as threats and standards evolve.
Browse by attack surface
Mirai is classified as botnet infrastructure; the Layer 3, 4 and 7 techniques it delivers are classified separately.
DDoS — Layer 3
Network-layer floods and malformed IP traffic that exhaust paths, routers or packet-processing capacity.
DDoS — Layer 4
Transport-layer attacks against TCP, UDP, state tables and exposed network services.
DDoS — Layer 7
Application and protocol abuse designed to consume web, API, DNS, TLS or game-service resources.
IoT & Mirai Botnets
Compromised cameras, routers, appliances and proxy networks used as distributed attack infrastructure.
Ransomware & Malware
Malicious code used for extortion, persistence, espionage, destruction, theft or unauthorized computing.
Web & API Attacks
Attacks against authorization, input handling, sessions, business logic and server-side application behavior.
Identity & Social Engineering
Account takeover and human-targeted methods that abuse credentials, trust, recovery flows or authentication.
Network & Infrastructure
Traffic interception, routing manipulation, name-service abuse and local-network attacks.
Cloud & Supply Chain
Compromise through cloud control planes, dependencies, build systems, containers and trusted vendors.
Data, Insider & Impact
Theft, manipulation, destruction, extortion and misuse of privileged access.
AI & Emerging Attacks
Attacks against models, agents, training data and AI-connected tools, plus fast-evolving abuse patterns.
Attack library
Search by attack name, alias, protocol or framework reference.
32 results
Complete catalog
DDoS — Layer 7
4 topicsApplication and API Resource Exhaustion
Valid requests are chosen for how expensive they are to answer, so a low request rate consumes disproportionate database, memory, downstream or financial capacity.
Open defensive briefHTTP Request Floods and Cache Bypass
Valid requests are sent in volumes, or aimed at routes, that cost the origin far more to answer than they cost the attacker to send.
Open defensive briefHTTP/2 and WebSocket Protocol Abuse
Features that make modern protocols efficient — stream multiplexing, header compression, persistent upgraded connections — become amplifiers when a client uses them adversarially.
Open defensive briefSlow-Rate and Handshake Exhaustion
Very little traffic occupies a disproportionate share of connections, workers or handshake capacity by being deliberately slow rather than fast.
Open defensive briefRansomware & Malware
4 topicsBackdoors, Rootkits and Living-Off-the-Land
Techniques for staying on a system and remaining unseen — from ordinary persistence entries, through firmware-level implants, to attacks that install nothing at all.
Open defensive briefCryptojacking and Self-Propagating Malware
Two consequences of the same access: quietly spending your compute for the operator's benefit, or spreading automatically to everything reachable.
Open defensive briefInfostealers and Spyware
Malware that takes credentials, session tokens and keystrokes rather than files — turning one infected machine into access everywhere that machine was signed in.
Open defensive briefRansomware, Extortion and Destructive Malware
Encryption, data theft and outright destruction are three endings to the same intrusion — the damage is decided long before the payload runs.
Open defensive briefIoT & Mirai Botnets
1 topicsWeb & API Attacks
5 topicsBroken Access Control and Logic Flaws
The application authenticates the user but fails to enforce what that user is allowed to do, in what order, or how often.
Open defensive briefCross-Site Scripting
Attacker-controlled script executes in another user's browser under the origin of the vulnerable site, inheriting that user's session and permissions.
Open defensive briefHTTP Protocol and Session Abuse
Disagreements between intermediaries about how a request is framed, cached or authorised let an attacker affect other users' traffic rather than only their own.
Open defensive briefInjection: SQL, Command, Template and Deserialization
Untrusted data crosses into an interpreter as code because it was combined with a query, command or object graph rather than passed as a parameter.
Open defensive briefSSRF and Path Traversal
A feature that fetches a resource accepts an untrusted destination, letting an attacker use the server's network position or filesystem access as their own.
Open defensive briefCloud & Supply Chain
3 topicsCloud Credentials, Storage and IAM Escalation
Cloud compromise is usually an identity event: a key leaves the trust boundary, a policy exposes data, or a modest permission turns out to grant far more than it appears to.
Open defensive briefContainer and Orchestration Attacks
Containers are process isolation, not a security boundary — and the orchestrator that schedules them is a powerful API that can run code anywhere in the cluster.
Open defensive briefSoftware Supply Chain Compromise
Attacking what you trust rather than what you expose — the build system, the dependency graph, or the update channel that delivers signed code to every customer.
Open defensive briefIdentity & Social Engineering
4 topicsCredential Stuffing and Password Spraying
Automation tests credentials against an identity population — either reused pairs from other breaches, or a few common passwords across many accounts.
Open defensive briefMFA Bypass: Real-Time Relay and Push Fatigue
The attacker stops trying to defeat the second factor and instead relays it in real time or persuades the user to approve it.
Open defensive briefPhishing, Consent Abuse and Business Email Compromise
Deception delivered through a trusted channel persuades a person to hand over credentials, authorise access, or move money.
Open defensive briefSIM Swap and Number Port-Out
An attacker takes control of a victim's phone number, inheriting every account that treats possession of that number as proof of identity.
Open defensive briefNetwork & Infrastructure
2 topicsDNS and Routing Hijacks
Attacks on the systems that decide where traffic goes — so a correct name or address delivers a victim to infrastructure the attacker controls.
Open defensive briefTraffic Interception and Downgrade
An attacker positions between two parties — on the local network, over wireless, or by weakening the encryption they negotiate — and reads or alters what passes.
Open defensive briefData, Insider & Impact
1 topicsAI & Emerging Attacks
3 topicsModel Denial of Service and Unbounded Consumption
Inference is expensive per request and the cost is largely chosen by the caller, so a small number of requests can exhaust capacity or budget.
Open defensive briefModel Supply Chain: Poisoning and Extraction
The integrity and confidentiality of a model are attacked through the data it learns from and the interface it answers through.
Open defensive briefPrompt Injection and Excessive Agent Agency
Untrusted content reaches a model as instructions, and the damage is set by whatever the model was permitted to do next.
Open defensive briefDDoS — Layer 4
3 topicsMulti-Vector & Pulse-Wave Campaigns
Attacks that change shape or timing during the incident, defeating defences tuned to a single vector or a steady load.
Open defensive briefReflection & Amplification
Forged requests cause third-party services to direct responses at a victim, frequently multiplying the attacker's bandwidth many times over.
Open defensive briefTCP State-Exhaustion Floods
Connection state is consumed faster than it can be released, so legitimate clients cannot obtain a session even while bandwidth remains available.
Open defensive briefDDoS — Layer 3
2 topicsSource Address Spoofing
Forged source IP addresses conceal an attacker's origin and make reflection attacks possible.
Open defensive briefVolumetric Network Floods
Raw packet or bit volume exhausts circuit capacity and packet-processing budgets before traffic ever reaches an application.
Open defensive brief