Offensive security assessments
Vulnerabilities
Coverage index for 48 assessment areas under Vulnerabilities, including Application Logic Flaws, Arbitrary Cookie Flags, Back Button Attack, Broken Authentication, and more.
Why it matters
We map 48 assessment areas under Vulnerabilities during this engagement. Each sub-topic documents methodology depth and business impact for that risk class.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Structured validation of Vulnerabilities during scoped assessment.
- Evidence captured with reproducible steps for your engineering team.
What we look for
- Misconfigurations and control gaps related to Vulnerabilities.
- Exploitable paths that could affect confidentiality, integrity, or availability.
Sub-topics
| Topic | Summary |
|---|---|
| Application Logic Flaws | Application Logic Flaws occur when a web application's normal logic or workflow can be manipulated, allowing attackers to bypass security measures or misuse functionality in unexpected ways. |
| Arbitrary Cookie Flags | Cookies that hold session or sensitive data are set without the proper security flags (Secure, HttpOnly, SameSite). This lets cookies travel over cleartext, be read by JavaScript, or be sent on cross-site requests, enabling theft and CSRF. |
| Back Button Attack | After a user logs out (or on a shared device), pressing the browser Back button or reopening cached pages reveals sensitive data or restores an authenticated view. This happens when the server lets responses be cached and does not fully invalidate the session. |
| Broken Authentication | Flaws in how an application confirms a user's identity, letting attackers compromise passwords, tokens, or sessions and assume other users' identities. It is one of the highest-impact web risks (OWASP Top 10: Identification and Authentication Failures). |
| Brute Force Attack | An attacker systematically tries many credentials, tokens, or values until one works. It succeeds when an endpoint lacks rate limiting, lockout, or sufficient secret entropy. |
| Captcha Bypass | A CAPTCHA is meant to block automated requests, but flawed implementation lets attackers skip or solve it programmatically. Bypassing it re-enables brute force, spam, and other automation the control was meant to stop. |
| Clickjacking | This engagement hosts a professional Proof of Concept (PoC) showcasing the Clickjacking vulnerability in web applications. Clickjacking represents a significant security concern, allowing unauthorized manipulation of user interactions and data access. |
| Command Injection | The application passes user-controlled input into an operating-system shell command without sanitization, letting an attacker run arbitrary commands on the host. It often leads to full server compromise. |
| CORS | CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the resource originated. A misconfigured CORS policy can allow attackers to make unauthorized cross-origin requests and access sensitive data. |
| Credential Stuffing | Attackers replay username/password pairs leaked from other breaches against a login endpoint, betting on password reuse. Unlike brute force, it uses known valid pairs, so even modest reuse yields account takeovers. |
| CRLF | We validate this area during scoped assessments, documenting impact and remediation guidance. |
| Cross-Site Request Forgery (CSRF) | Cross-Site Request Forgery (CSRF) is an attack that tricks a user into executing unwanted actions on a web application where they are authenticated. By exploiting the trust that a website has in the user's browser, an attacker can perform actions on behalf of the user without th… |
| Deserialization Vulnerability | Serialization is the process of converting an object's state (such as data or a structure) into a format that can be easily stored, transmitted, or transferred, such as JSON, XML, or binary. |
| Directory Traversal | Directory Traversal is a web application vulnerability that allows an attacker to access files and directories stored outside the intended web root. |
| GraphQL Injection | GraphQL exposes a single flexible endpoint where clients shape their own queries. Attacks abuse introspection to map the schema, then exploit missing authorization, injection sinks behind resolvers, and the lack of query-cost limits. Common outcomes: data exposure, IDOR/BOLA thr… |
| Host Header Injection | The application trusts the client-supplied Host header (or related headers like X-Forwarded-Host) when building URLs, links, or routing decisions. An attacker can spoof it to poison links, reset emails, or caches. |
| HTTP Request Smuggling | HTTP Request Smuggling happens when a front-end server (proxy, load balancer, CDN) and a back-end server disagree on where one request ends and the next begins. An attacker abuses this desync to prepend a hidden request to another user's traffic, leading to cache poisoning, requ… |
| IDOR | Got it! Here's a nicely formatted and easy-to-read Markdown table and cheatsheet for IDOR (Insecure Direct Object Reference) payloads, bypasses, and testing notes: |
| Improper Error Handling | The application returns verbose errors, stack traces, or debug output that reveal internal details such as file paths, SQL queries, framework versions, or secrets. This aids attackers in mapping and exploiting the system. |
| Information Disclosure | The application unintentionally exposes sensitive data such as credentials, internal paths, API keys, PII, or system details. Even when not directly exploitable, it gives attackers material to plan deeper attacks. |
| Insecure Object Storage | Cloud object storage (S3, Azure Blob, GCS) is misconfigured so buckets or objects are world-readable, writable, or listable. This exposes sensitive files and can allow tampering or content injection. |
| Insufficient Security Controls | Security defenses that should be present are missing, weak, or only partially applied, such as absent authorization checks, no rate limiting, missing input validation, or inconsistent enforcement across endpoints. Attackers exploit the gaps. |
| Insufficient Transport Layer Protection | Data in transit is not adequately protected by TLS, due to missing HTTPS, mixed content, weak protocols/ciphers, or no HSTS. Attackers on the network can intercept or tamper with traffic, including credentials and session tokens. |
| JWT Attacks | JSON Web Tokens (JWT) are signed, base64url-encoded tokens (header.payload.signature) used for stateless auth. Attacks target weak or missing signature verification so an attacker can forge or tamper with claims (e.g. flip "role":"user" to "admin", change the sub/user id) and ga… |
| Misconfigured HTTP Headers | Security-relevant HTTP response headers are missing, weak, or set incorrectly. This weakens browser-side defenses and can enable clickjacking, XSS, MIME sniffing, information leakage, and downgrade attacks. |
| Open File Upload | This page covers the specific angle of upload functionality and uploaded files being exposed without proper access control. For full exploitation of upload validation flaws (web shells, extension and content-type bypasses), see the sibling Unrestricted File Upload page. |
| Open Redirect | An open redirect occurs when an application takes a user-controlled value and uses it as the target of a redirect without validation. Attackers abuse the trusted domain to send victims to malicious sites, aiding phishing, credential theft, and OAuth token theft. |
| Outdated TLS Version | A server supporting deprecated protocols (SSLv2/v3, TLS 1.0, TLS 1.1) exposes traffic to known attacks and weakens transport security. These versions are formally deprecated (RFC 8996) and fail modern compliance baselines. |
| Path Traversal | Path traversal (directory traversal) lets an attacker read or write files outside the intended directory by injecting ../ sequences into a file path the application builds from user input. It can expose source code, credentials, and system files. |
| Privilege Escalation | Privilege escalation is when a user gains access or capabilities beyond what their role permits. Vertical escalation reaches higher privileges (user to admin); horizontal escalation reaches another user's data at the same level. |
| Race Condition | A race condition occurs when concurrent requests hit a time-of-check-to-time-of-use (TOCTOU) gap, letting an operation execute more times than the logic intended. It commonly breaks limits on redemptions, withdrawals, votes, and one-time actions. |
| Remote Code Execution (RCE) | Remote code execution lets an attacker run arbitrary commands or code on the target server. It is one of the most severe web vulnerabilities, typically yielding full server compromise, data theft, and lateral movement. |
| Security Header Missing | Missing or misconfigured HTTP response headers remove defense-in-depth protections, leaving the app more exposed to clickjacking, MIME sniffing, protocol downgrade, and cross-site scripting. The headers do not fix root causes but reduce exploitability. |
| Server Misconfigurations | Security misconfiguration covers insecure defaults, exposed admin interfaces, verbose errors, directory listing, and unhardened services. It is OWASP Top 10 A05 and is frequently the easiest path to sensitive data or further compromise. |
| Server-Side Template Injection (SSTI) | Server-Side Template Injection (SSTI) is a type of security vulnerability that occurs when user input is insecurely embedded in server-side templates, allowing an attacker to execute arbitrary code on the server. This can lead to data exposure, remote code execution, and other m… |
| Session Fixation | Session fixation lets an attacker set or predict a victim's session identifier before login, then reuse that identifier after the victim authenticates to hijack their session. The flaw is the failure to rotate the session ID at privilege change. |
| SQL Injection | The impact of a successful SQL Injection attack can be severe, affecting the integrity, confidentiality, and availability of data. Some of the most critical consequences include: |
| SSRF | Server-Side Request Forgery (SSRF) is a type of vulnerability that allows an attacker to trick a vulnerable web application into making requests to unintended locations. This can enable the attacker to access sensitive internal resources, like databases or metadata services, tha… |
| tabnabbing | Reverse tabnabbing happens when a page opens a link in a new tab and the destination gains access to the opener via window.opener. The malicious destination can silently navigate the original tab to a phishing page while the victim is on the new tab. |
| Unrestricted File Upload | Unrestricted file upload occurs when an application accepts files without validating type, content, name, or storage location. It can lead to remote code execution (web shells), stored XSS, or overwriting critical files. |
| Unsecured API Endpoints | Unsecured API endpoints expose functionality or data without proper authentication, authorization, or rate limiting. They are a top API risk (OWASP API Security Top 10) and often leak sensitive data or allow unauthorized actions. |
| Unvalidated Redirects and Forwards | Applications that redirect (client-side, 30x) or forward (server-side dispatch) to a destination taken from user input without validation can send users to malicious sites or bypass access controls on internal targets. |
| Weak Ciphers | Weak ciphers are TLS cipher suites or cryptographic algorithms that offer insufficient strength, such as RC4, DES/3DES, export-grade, NULL, or anonymous suites. They allow decryption, downgrade, or integrity attacks against otherwise encrypted traffic. |
| Web Cache Deception | Web cache deception tricks a caching layer into storing a victim's dynamic, sensitive response under a URL the attacker can later retrieve. It abuses the mismatch between how the cache decides what is cacheable and how the origin maps the path. |
| Web Cache Poisoning | Web Cache Poisoning tricks a caching layer (CDN, reverse proxy, in-app cache) into storing a harmful response, which is then served to every user who requests the same cached key. Unlike Web Cache Deception (which leaks one victim's private page), poisoning weaponises a single r… |
| Web LLM Prompt Injection | Modern web apps embed LLM features (chatbots, support assistants, summarisers, agents with tools). Prompt injection makes the model treat attacker-controlled text as instructions, overriding the developer's system prompt. Because the LLM often has access to APIs, user data, and… |
| XML External Entity (XXE) | XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any backend o… |
| XSS | We validate this area during scoped assessments, documenting impact and remediation guidance. |