Dictionary

XSS

Cross-Site Scripting

Cross-Site Scripting (XSS) is a vulnerability that lets an attacker inject malicious JavaScript into web pages viewed by other users. The victim's browser executes the script believing it comes from a legitimate source, which allows stealing cookies, session tokens or redirecting the user to malicious sites.

SSRF

Server-Side Request Forgery

Server-Side Request Forgery (SSRF) is a vulnerability that lets an attacker make the server send HTTP requests to arbitrary destinations. This can expose internal services, cloud metadata (such as AWS/GCP credentials) and allow scanning the organization's internal network.

SQLi

SQL Injection

SQL Injection (SQLi) is a vulnerability that lets an attacker interfere with the SQL queries an application sends to its database. By injecting malicious SQL into input fields, the attacker can read, modify or delete data, and even run commands on the operating system.

IDOR

Insecure Direct Object Reference

Insecure Direct Object Reference (IDOR) is an access-control vulnerability where the application exposes direct references to internal objects (such as database IDs) without verifying that the user is authorized to access them. An attacker can tamper with these references to reach other users' data.

CSRF

Cross-Site Request Forgery

Cross-Site Request Forgery (CSRF) is a vulnerability that lets an attacker trick an authenticated user's browser into sending unwanted requests to a web application. Because the browser automatically includes the session cookies, the application processes the request as if it were legitimate.

Open Redirect

Open Redirect is a vulnerability that occurs when a web application redirects users to a URL supplied through a parameter without proper validation. Attackers exploit it to send victims to phishing sites using a seemingly legitimate link from the trusted domain.

XXE

XML External Entity Injection

XML External Entity (XXE) is a vulnerability that abuses the external-entity feature of XML parsers. When an application processes input XML without disabling external entities, an attacker can read files from the server, perform SSRF or cause a denial of service.

Path Traversal

Path Traversal / Directory Traversal

Path Traversal is a vulnerability that lets an attacker access files and directories outside the application's root directory using sequences like ../. The attacker can read sensitive operating-system files, the application's source code or configuration files containing credentials.

LFI

Local File Inclusion

Local File Inclusion (LFI) is a vulnerability that lets an attacker include local server files by tampering with input parameters. Unlike Path Traversal, which only reads files, LFI can execute code if the included file contains code in the server's language (PHP, JSP, etc.).

CORS Misconfiguration

Cross-Origin Resource Sharing Misconfiguration

A CORS misconfiguration occurs when a server defines overly permissive Cross-Origin Resource Sharing policies, allowing malicious websites to read responses from the authenticated API. This can enable theft of the user's sensitive data from an attacker-controlled domain.

SSTI

Server-Side Template Injection

Server-Side Template Injection (SSTI) occurs when user input is inserted directly into a server-side template (Jinja2, Twig, Freemarker, etc.) without sanitization. The attacker can inject template-engine expressions to execute arbitrary code on the server.

Command Injection

OS Command Injection

Command Injection is a vulnerability that lets an attacker run operating-system commands on the server through a vulnerable application. It happens when the application passes user input directly to system command-execution functions (exec, system, popen, etc.).

Race Condition

A Race Condition is a vulnerability that occurs when an application's behavior depends on the sequence or timing of uncontrolled events. In web applications, an attacker can send multiple simultaneous requests to exploit time windows where security checks are not applied atomically.

Clickjacking

Clickjacking / UI Redressing

Clickjacking is an attack that tricks the user into clicking elements of a legitimate web page hidden inside a transparent iframe. The attacker overlays their own page on top of the target page, so that when the user thinks they are interacting with the visible page they are actually clicking on the hidden one.

Subdomain Takeover

Subdomain Takeover happens when a subdomain points (via CNAME or A record) to an external service that is no longer in use or has not been claimed. An attacker can register that external service and take control of the subdomain, serving malicious content, stealing cookies from the parent domain or running convincing phishing.

CRLF Injection

CRLF Injection / HTTP Response Splitting

CRLF Injection occurs when an attacker can inject carriage-return (\r) and line-feed (\n) characters into the HTTP response headers. This lets them split the HTTP response, inject arbitrary headers, set malicious cookies or even inject HTML/JavaScript content into the response body.

Host Header Injection

Host Header Injection is a vulnerability that occurs when an application blindly trusts the value of the HTTP request's Host header. An attacker can tamper with this header to poison password-reset links, manipulate routing or poison web caches.

HTTP Smuggling

HTTP Request Smuggling

HTTP Request Smuggling is a vulnerability that abuses discrepancies in how front-end servers (proxies, load balancers) and back-end servers interpret the boundaries between HTTP requests. The attacker sends ambiguous requests that are processed differently, allowing them to 'smuggle' one request inside another.

Prototype Pollution

Prototype Pollution is a JavaScript-specific vulnerability that lets an attacker modify the prototype of base objects (Object.prototype). By injecting properties into the prototype, every object in the application inherits them, which can lead to XSS, security bypasses or remote code execution.

DOM Clobbering

DOM Clobbering is a web attack technique where the attacker injects HTML elements that overwrite global properties of the JavaScript DOM. Using attributes such as id or name on HTML elements, global references are created that can replace variables, objects or functions the JavaScript code expects, altering its behavior.

Cache Poisoning

Web Cache Poisoning

Web Cache Poisoning is a vulnerability that abuses the behavior of web caches (CDNs, proxies) to store and serve malicious responses to other users. The attacker sends a request with headers or parameters that are not part of the cache key but do affect the response, causing the poisoned version to be served to every visitor.

Mass Assignment

Mass Assignment is a vulnerability that occurs when an application automatically binds the values of an HTTP request to the fields of a data model or object without filtering which fields may be modified. An attacker can add extra fields to the request to change sensitive attributes such as role, status or price.

Broken Access Control

Broken Access Control covers every flaw where users can act outside their intended permissions. It includes horizontal privilege escalation (accessing data of other users with the same role) and vertical escalation (performing actions of a higher role). It is the #1 vulnerability in the OWASP Top 10 2021.

NoSQL Injection

NoSQL Injection is a vulnerability that lets an attacker interfere with the queries of NoSQL databases (such as MongoDB, CouchDB) by injecting malicious operators or expressions. Unlike SQL Injection, it abuses the structure of object/JSON-based queries and DBMS-specific operators.