Bookmarks | PhotoDune

v3xx's collections

[ AppSec | Remote File Inclusion ]
By v3xx
Using remote file inclusion (RFI), an attacker can cause the web application to include a remote file. This is possible for web applications that dynamically include external files or scripts.

0 Items
[ AppSec | Local File Inclusion ]
By v3xx
Local file inclusion (LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application.

1 Item
[ AppSec | SQL Injection ]
By v3xx
A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data, execute administr...

8 Items
[ AppSec | Shortcode Injection ]
By v3xx
Content spoofing, also referred to as content injection, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application doesn't properly handle user-supplied data, an attacker can supply content...

1 Item
[ AppSec | File Upload ]
By v3xx
File upload vulnerabilities are when a web server allows users to upload files to its filesystem without sufficiently validating things like their name, type, contents, or size. Failing to properly enforce restrictions on these could mean that eve...

21 Items
[ AppSec | Abuse of Functionality ]
By v3xx
Business logic vulnerabilities are flaws in the design and implementation of an application that allow an attacker to elicit unintended behavior. This potentially enables attackers to manipulate legitimate functionality to achieve a malicious goal.

2 Items
[ AppSec | Privilege Escalation ]
By v3xx
Privilege escalation is a process through which an unauthorized user gains access to resources restricted to a specific group of people, such as data that is restricted to users with specific WordPress user roles.

4 Items
[ AppSec | Info Exposure ]
By v3xx
Information disclosure, also known as information leakage or information exposure, is when a website unintentionally reveals sensitive information to its users.

3 Items
[ AppSec | Broken Access Control ]
By v3xx
Access control is the application of constraints on who or what is authorized to perform actions or access resources. Broken access controls are common and often present a critical security vulnerability.

2 Items
[ AppSec | CSRF ]
By v3xx
Cross-site request forgery (CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform.

11 Items
[ AppSec | Spoofing ]
By v3xx
A spoofing attack is a situation in which a person or program successfully identifies as another by falsifying data, to gain an illegitimate advantage.

2 Items
[ AppSec | IDOR ]
By v3xx
Insecure Direct Object References (IDOR) occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, fo...

12 Items
[ AppSec | XSS ]
By v3xx
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form...

114 Items