Application Attacks 46 articles

Summary HTTP Request Smuggling is a web application attack technique that exploits inconsistencies in the way HTTP requests are processed by different servers or intermediaries, allowing attackers to bypass security…

Summary Insecure deserialization is a security vulnerability that occurs when untrusted data is deserialized by an application, allowing attackers to manipulate serialized objects to execute arbitrary code, escalate privileges, or…

Summary JWT Attacks exploit vulnerabilities in JSON Web Tokens (JWT) used for authentication and authorization, enabling attackers to bypass security controls or impersonate users. Key Characteristics Manipulation of JWT payloads…

Summary Malicious File Upload is an application attack where attackers upload harmful files to a target system, enabling unauthorized access, code execution, or data compromise. Key Characteristics Exploitation of file…

Summary Mass Assignment is a web application vulnerability where attackers manipulate object properties by submitting unexpected or unauthorized parameters during data binding, leading to unauthorized data modification or privilege escalation.…

Summary NoSQL Injection is a type of application attack that targets NoSQL databases by exploiting improper input validation to manipulate database queries, allowing attackers to access, modify, or delete data…

Summary OAuth Misconfiguration Abuse is an application attack where attackers exploit improper OAuth implementation or configuration to gain unauthorized access to resources or user data. This abuse typically arises from…

Summary Open Redirect is a web application vulnerability where an attacker exploits a URL redirection mechanism to redirect users to malicious websites, often facilitating phishing, malware distribution, or credential theft.…

Summary Path Traversal is a type of application attack where an attacker manipulates file paths to access files and directories outside the intended scope, potentially exposing sensitive data or system…

Summary Privilege Escalation (Application-level) is a type of cyberattack where an attacker exploits vulnerabilities within an application to gain elevated access rights beyond their authorized permissions. This allows the attacker…

Summary Prototype Pollution is a type of application attack targeting JavaScript applications by manipulating the prototype of base objects, enabling attackers to inject or modify properties that affect the behavior…

Summary Race Condition Attacks exploit timing vulnerabilities in software or systems where multiple processes access shared resources concurrently, leading to unexpected behavior or security breaches. Attackers manipulate the sequence or…

Summary Rate Limiting Bypass is an application attack technique where an attacker circumvents restrictions designed to limit the number of requests a user or IP address can make to a…

Summary Reflected Cross-Site Scripting (Reflected XSS) is a web application vulnerability where malicious scripts are injected into a web page and immediately reflected back to the user, allowing attackers to…

Summary Remote Code Execution (RCE) is a critical security vulnerability that allows an attacker to execute arbitrary code on a target system or application from a remote location, often leading…

Summary Server-Side Request Forgery (SSRF) is a web security vulnerability that allows an attacker to induce a server to make unintended requests to internal or external resources. Exploiting SSRF can…

Summary Session Fixation is a web application attack where an attacker tricks a user into using a known session ID, allowing the attacker to hijack the user’s authenticated session and…

Summary Session Hijacking is a type of application attack where an attacker takes over a valid user session to gain unauthorized access to information or services within a web application…

Summary SQL Injection (SQLi) is a type of application attack where an attacker exploits vulnerabilities in a web application's database query execution by injecting malicious SQL code. This allows unauthorized…

Summary Stored Cross-Site Scripting (Stored XSS) is a web application vulnerability where malicious scripts are permanently injected into a target website’s database, message forum, or other data storage. When users…