Resumen
The Web offers adversaries a powerful infrastructure to compromise computer systems and monetize the resulting computing resources as well as any information that can be stolen from them. Adversaries achieve this by employing the Web to serve malicious Web content capable of compromising users' computers and running arbitrary code on them. Turning Web servers into infection vectors is unfortunately fairly straightforward. In general, these attacks aim at altering Web site content to redirect visitors to servers controlled by the adversary. Once the adversaries have turned a Web server into an infection vector, visitors to that site are subjected to various exploitation attempts. In general, client exploits fall under two main categories: automated drive-by downloads and social engineering attacks. Unfortunately, the root cause that allows the Web to be leveraged for malware delivery is an inherent lack of security in its design -- neither Web applications nor the Internet infrastructure supporting these applications were designed with a well-thought-out security model.