L7 attacks: what to look for

Every L7 attack leaves a signature in the logs. Knowing each pattern is what turns an ocean of requests into hypotheses you can test.

OWASP Automated ThreatsMITRE ATT&CKOWASP Top 10OWASP Core Rule Set

What it is

Layer 7 attacks use the application's own protocol (HTTP) to exploit logic, credentials or capacity. Many look like legitimate traffic request by request, and only the whole reveals the pattern, so detection is largely statistical and behavioral.

Six patterns and the signature of each

: many login attempts with leaked username/password pairs, failures (401) in volume, many IPs and user agents, few attempts per account.
L7 DDoS: request spike to a few expensive paths (search, reports), many IPs, low rate per IP but very high in aggregate.
Forced browsing: scanning of nonexistent or administrative paths (/admin, /.git, /backup), an explosion of 404 and 403 from one origin.
Probing and : a sequence of identifiers in order (/orders/1001, 1002, 1003...) within the same session, seeking access to other users' objects.
SSRF: URL parameters pointing to internal or metadata addresses (169.254.169.254, localhost), in fields the application fetches server-side.
Injections (SQL, command, template): syntax characters and keywords in parameters, headers or body, often as probing attempts before the real attack.

From pattern to detection hypothesis

For each pattern, the question is "which field, in what window and grouped by what reveals this?". Credential stuffing, for example, is not visible by IP (the botnet distributes), but it is visible in the failure ratio by ASN or by fingerprint, and in the number of distinct accounts tried per origin.

hypotheses per patterntext

credential stuffing -> login failures / minute per ASN, distinct accounts per fingerprint
L7 DDoS             -> reqs / minute per expensive path, ratio vs hourly baseline
forced browsing     -> 404+403 per origin, distinct paths per window
IDOR                -> sequential IDs per session, denied access to others' objects
SSRF                -> parameters with private IP/metadata in URL fields
injection           -> syntax tokens in parameters, repeated and varying

Attackers adapt

When you block by IP, the attack changes IP; when you block by user agent, it rotates. The most durable detections anchor on characteristics that are hard to change: fingerprints, behavior, the target's own logic. And every change in pattern should become a new detection or an adjustment, recorded together with the incident that motivated it.

Credential stuffingAttack that tests leaked username/password pairs from other services at scale. Signature: many login failures spread across many IPs, with few attempts per account.see in glossary →IDORinsecure direct object reference · BOLAThe request names an object (an id) and the server returns it without checking that the caller may see it. The most common form of broken access control, and in APIs it is called broken object level authorization.see in glossary →

connections on the map

Edge and application telemetryrevealsL7 attacks: what to look for
L7 attacks: what to look forbecomes detectionDetection engineering

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Threat intelligenceresponsetechniques observed at the edge feed intelligence and vice versa
A05 Injectionowaspseen from outside: the signatures at the edge

Unlocks

test what you learned

Loading questions…