Every OSI Layer Attack, Explained Through Food Delivery

Last time, we walked through the OSI model by ordering pizza on a delivery app — seven layers, seven things that quietly happen every time you tap "order." Each layer got one example of what goes wrong.

This time: all of it. Every layer, every major way it actually gets attacked, still tied back to the pizza order — but now as a reference you can actually use, not just a story you read once.

One honest caveat before we start: the OSI model is a teaching tool, not a law of physics. Plenty of real attacks and protocols don't respect these boundaries cleanly — TLS spans several layers at once, and plenty of "session hijacking" today is really an application-layer problem wearing a session-layer name. Where that's true, it's called out below.

Layer 7 — Application: when the order itself is the weapon

This is the layer you see — the app, the menu, the "place order" button. It's also the layer with, by far, the most named attacks, because it's the layer closest to real people and real money.

Phishing — A fake app or login page tricks you into typing your card or password details directly. Memory hook: The fake delivery driver who just asks for your wallet.

SQL Injection — Malicious text in a form field gets run as a database command instead of plain text. Memory hook: "Also, empty the safe" written on your delivery note — and it works.

Cross-Site Scripting (XSS) — A planted script runs in other users' browsers as if the app itself sent it. Memory hook: A poisoned note in "special instructions" that runs on every future customer's screen.

Cross-Site Request Forgery (CSRF) — You're tricked into unknowingly submitting a request to a site you're already logged into. Memory hook: A pre-filled reorder slip slipped into your hand while you're still logged in.

Command / OS Injection — Malicious input gets executed as a system-level command on the server itself. Memory hook: The forged note that tells the whole kitchen to shut down, not just the register.

Broken Access Control (IDOR) — The app fails to check you own the record you're asking for, exposing someone else's data. Memory hook: Swapping the receipt number at pickup and getting a stranger's bag.

Credential Stuffing — Large lists of stolen username/password pairs are thrown at a login page until one works. Memory hook: Trying every key on a giant janitor's ring against your front door.

Layer 6 — Presentation: when the translation is tampered with

This layer translates your order into a format the restaurant, the payment gateway, and the delivery app can all agree on — including encrypting your card details along the way. Fewer named attacks live here specifically, mostly because much of what people call "layer 6 attacks" is really encryption or serialization tampering that shows up during that translation step.

TLS Stripping (Downgrade) — An attacker forces the connection down to an unencrypted or weaker version mid-transit. Memory hook: Your sealed order envelope swapped for an open, unsealed one.

Encryption Implementation Flaws — Bugs in how TLS/SSL itself is implemented (e.g. Heartbleed, POODLE) leak supposedly private data. Memory hook: A defect in the translator's notebook lets someone photograph the "before" page.

Insecure Deserialization — An app trusts structured data from an untrusted source without validating it first. Memory hook: A delivery ticket format so trusted nobody double-checks a forged one.

Encoding / Unicode Normalisation — Abusing alternate text encodings to sneak malicious input past filters checking only the "normal" form. Memory hook: Writing an order in a script the filter doesn't recognise as the banned word.

Worth noting: TLS itself doesn't live cleanly in layer 6 — it operates across the session, presentation, and transport layers depending on how you look at it. Insecure deserialization is also usually classified as an application-layer (layer 7) vulnerability in frameworks like the OWASP Top 10 — it's included here because the underlying idea, data format tampering, is a presentation-layer concept.

Layer 5 — Session: when someone hijacks the conversation itself

This is the layer that keeps your order as one continuous thread from "placed" to "delivered," even if your phone dies and you reopen the app later. Attacks here are about stealing or forging that continuity.

Session Hijacking — An attacker steals the token proving "this is an ongoing, logged-in conversation." Memory hook: Stealing your order-tracking ID so the app thinks you're the one asking.

Session Fixation — You're tricked into using a session ID the attacker already controls from the start. Memory hook: Being handed a tracking number they already have a copy of.

Session Replay — A captured, legitimate exchange (like a login handshake) is recorded and resent later. Memory hook: Recording the exact call that placed a real order, then replaying it.

MITM at Session Handshake — An attacker inserts themselves during setup so both sides unknowingly talk through them. Memory hook: Someone quietly relaying messages, pretending to be each side to the other.

Worth noting: a lot of what's casually called "session hijacking" today is really an application-layer (layer 7) cookie/token theft problem, since modern apps manage sessions in application code, not a dedicated OSI session-layer protocol. It's kept here because that's still the most intuitive place to first understand the concept.

Layer 4 — Transport: when delivery guarantees get abused

This layer's whole job is making sure every piece of your order arrives, and arrives complete. Its attacks mostly abuse that guarantee-and-tracking mechanism itself.

SYN Flood — A flood of connection requests are sent but never completed, exhausting server resources. Memory hook: Hundreds of fake calls that hang up right after "hello," each holding a line open.

UDP Flood — A flood of handshake-free UDP traffic simply overwhelms a target with sheer volume. Memory hook: Someone blasting the restaurant's phone line with silent calls.

TCP Reset (RST) Injection — A forged "connection reset" packet forcibly and prematurely kills an active connection. Memory hook: Someone impersonating the restaurant to cancel an order that was never cancelled.

Port Scanning — Reconnaissance: systematically probing which services on a system are open before an attack. Memory hook: Walking down the block checking which doors are unlocked first.

Layer 3 — Network: when the route itself gets sabotaged

This layer is responsible for figuring out the path data takes from one network to another — the equivalent of mapping the best route across the city. Its attacks are all about corrupting that map.

IP Spoofing — An attacker forges the source address on packets, making traffic look like it's from someone else. Memory hook: A delivery labeled with a fake return address.

BGP Hijacking — False routing information is announced, sending internet traffic somewhere it was never meant to go. Memory hook: Repainting the city's road signs so routes cross through one neighborhood first.

ICMP Flood / Smurf Attack — A target is flooded with ping traffic, sometimes by tricking a whole network into replying at once. Memory hook: Forging the return address on a mass mailing so every reply floods one mailbox.

IP Fragmentation (Teardrop) — Malformed, overlapping data fragments crash or confuse the system trying to reassemble them. Memory hook: Shipping a disassembled item with mismatched, overlapping instructions.

Layer 2 — Data Link: when the local handoff gets hijacked

Once a delivery is in your neighborhood, this layer is about finding your exact door on the local network — and its attacks all happen at that same close, local range.

ARP Spoofing / Poisoning — Devices on the local network are tricked into thinking the attacker's device is the one they meant to reach. Memory hook: Someone impersonating the rider right at your gate, intercepting the handoff.

MAC Flooding — A switch's memory is overwhelmed with fake addresses, forcing it to broadcast traffic to everyone. Memory hook: So many riders claiming your street that mail just gets handed to everyone.

VLAN Hopping — Misconfigurations are exploited to send traffic into a network segment it shouldn't reach. Memory hook: Sneaking from visitor parking into the staff-only lot through an unlocked gate.

MAC Spoofing — An attacker changes their device's address to impersonate another trusted device on the network. Memory hook: Swapping your delivery bike's plate for a trusted courier's plate.

Layer 1 — Physical: when it's not clever, it's just physical access

Strip everything else away, and this is cables, radio waves, and hardware. Its attacks don't need cleverness with protocols — just physical proximity or access.

Wiretapping / Cable Tapping — Physically connecting to a cable to intercept the raw signal before it's even structured data. Memory hook: Literally cutting into the bike's route to peek inside the bag.

Rogue Access Point / Evil Twin — A fake wireless network with a trustworthy name captures everything that connects to it. Memory hook: A fake storefront set up next door, intercepting customers first.

Signal Jamming — Flooding a frequency with noise to disrupt or block legitimate wireless communication. Memory hook: A loud engine revving outside so the rider can never hear their phone ring.

Hardware Implants / Keyloggers — A physical device on a cable, keyboard, or port captures data before it's ever encrypted. Memory hook: A hidden camera taped inside the order pad, copying every ticket.

Device Theft / Physical Access — Simply taking or tampering with hardware directly defeats nearly every network-level protection. Memory hook: No need to hack anything if you can just walk in and take the bike.

Quick-reference cheat sheet

Layer 7 — Application: Phishing, SQL injection, XSS, CSRF, command injection, broken access control, credential stuffing. Typical defense: Web Application Firewall (WAF), input validation, MFA

Layer 6 — Presentation: TLS stripping/downgrade, encryption implementation bugs, insecure deserialization, encoding bypass. Typical defense: Enforce TLS/HSTS, keep crypto libraries patched, validate serialized data

Layer 5 — Session: Session hijacking, session fixation, replay attacks, MITM at handshake. Typical defense: Secure/rotating session tokens, short session lifetimes, MITM-resistant handshakes

Layer 4 — Transport: SYN flood, UDP flood, TCP RST injection, port scanning. Typical defense: Rate limiting, SYN cookies, firewalls, intrusion detection

Layer 3 — Network: IP spoofing, BGP hijacking, ICMP flood/Smurf, IP fragmentation attacks. Typical defense: Ingress/egress filtering, route authentication (RPKI), anti-spoofing rules

Layer 2 — Data Link: ARP spoofing, MAC flooding, VLAN hopping, MAC spoofing. Typical defense: Port security, dynamic ARP inspection, VLAN segmentation

Layer 1 — Physical: Wiretapping, rogue APs/evil twin, signal jamming, hardware implants, device theft. Typical defense: Physical access control, cable shielding, wireless intrusion detection

The pattern worth remembering: as you go down the stack, attacks get less about tricking people and more about exploiting infrastructure — until, at the very bottom, it's not a protocol problem at all. It's just "who can get close enough to touch it."

This is the sequel to The OSI Model, But It's Food Delivery. Next in the series: HTTP vs HTTPS — what's actually happening during a TLS handshake, also explained without the textbook version.