Vulnerability Definitions + Remediations

Use parameterized queries/prepared statements and apply least-privilege database permissions

Context-aware output encoding
HTML sanitization / safe DOM API's
CSP as defense in depth

Server side authorization checks on every resource or action
Deny Access By Default
Apply Least Privilege

Enforce MFA
Apply login rate limiting and account lockout
Enforce secure password policies

Disable external entity resolution
Disable unnecessary DTD processing

Implement unpredicatable anti-CSRF tokens
Configure SameSite Cookies
Validate Origin Headers

Enforce HTTPS with Secure and use HTTPOnly cookies
Use session expiration, revocation, and roation

Regenerate sessions IDs after logins and privilege changes
Discard old session ID's

Allowlist approved destinations, firewall on sensitive endpoints, egress filtering

Avoid user controlled file paths
canonicalize file paths and validate the result against a whitelist of trusted file paths/directories

Avoid shell execution and if not pass validated arguments through safe process APIs

Enforce Business rules server-side
test for workflow bypasses and abuse cases

Restrict access to sensitive information
Minimize error details
encrypt infromation

implement MFA
Enforce rate limiting and account lockouts
Detect and block suspicious login activies

Because malicious input can take different forms, and input filtering does not reliably separate SQL commands from data. Parameterized queries do.

Because attackers may use encoded paths, alternative separators, or other representations. Normalize and resolve paths before checking that they remain within the authorized directory.

Because an attacker can rename malicious content to use an allowed extension. The application should validate file types, isolate uploaded files, and prevent their execution

Because signing prevents unauthorized modification of the token, not reuse of a valid stolen bearer token.

A vulnerability where untrusted input alters a SQL query, allowing attackers to execute unintended database operations.

A vulnerability where untrusted content executes as malicious JavaScript in another user's browser

Occurs when malicious Javascript is stored by an application and executed when a victims views the affected content

Occurs when malicious input is reflected in a servers response and executed in a victim's browser

Occurs when client side javascript unsafely handles user-controlled input, causing malicious JavaScript to execute in the browser

A vulnerability where an application fails to enforce permissions, allowing users unauthorized access to resources or actions

An application fails to verify authorization for a requested objects, allowing users to access others resources

Gaining unauthorized access to another user's resources or account at the same privilege leve

Gaining unauthorized access to higher-level privileges or functionality, such as administrator capabilities.

Scope -> Recon -> Enumerate -> Test -> Validate -> Report

Identify technologies, endpoints, parameters, authentication mechanisms and potential entry points

To confimr vulnerabilities are exploitable and determine their actual impact

Evidence, reproduction steps, severity, business impact, remediation and recommendations

Authentication verifies identity while authorization verifies permission

Horizonal accesses another user's resources, while vertical gains higher level privileges

Use accounts with different permissions and manipulate resource IDs or restricted endpoints

Enforce server-side authorization, deny by default, apply least privilege

Inject SQL test payloads into user-controlled inputs and observe errors, response differences or time delays that indicate SQL injection

Retrieving hidden data, authentication bypass, UNION attacks, Blind SQL injection

Stored = saved payload Reflected = immediate server response DOM-XSS = client side Javascript processing

Restricts which resources of scripts the browser may load or execute, providing defnese in depth

A web application security toolkit for inspecting and manipulating HTTP traffic

Intercepts and inspects HTTP requests and responses between a server and browser

Manually modifies and resends HTTP requests

Automates sending HTTP request with different payloads to test application behavior

SQLi manipulates database queries; XXE abuses XML parsers; SSRF causes unintended server-side requests.

Use two test accounts and modify resource IDs to check for unauthorized access

The server returns or modifies a resource that the request user isn't authorized to access