Authenticated - threat actor have to be logged in to perform vulnerability attack
Unauthenticated - threat actor doesn't need to be logged in to perform vulnerability attack
Cross-Site Scripting (XSS) - this is a vulnerability that allows a threat actor to inject malicious scripts usually browser side which are executed by end user while browsing.
These malicious scripts can but not limited to access/steal cookies, session tokens, sensitive data retained by browser.
Types of XSS:
1. Reflected XSS (Non-persistent Type I):
Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data
2. Stored XSS (Persistent Type II):
Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, we can envision the attack payload being permanently stored in the victim’s browser, such as an HTML5 database, and never being sent to the server at all
3. DOM based XSS (Type-0):
DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment
Server Side Request Forgery (SSRF) - this vulnerability allows attacker to abuse the functionality on the server to read or update internal resources.
The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.
SQL Injection - this attack consists of insertion or “injection” of a SQL query via the input data from the client to the application.
A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands
Local File Inclusion (LFI) - is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application.
This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected.
Bypass vulnerability - this can allow a threat actor to bypass certain restrictions in the code
Remote Code Execution (RCE - Code Injection) - this vulnerability allows a threat actor to execute arbitrary code in the programming language in which the developer wrote that application.
The term remote means that the attacker can do that from a location different than the system running the application. This type of vulnerability can range from very hard to find to easy to find in the code.
Unauthenticated - threat actor doesn't need to be logged in to perform vulnerability attack
Cross-Site Scripting (XSS) - this is a vulnerability that allows a threat actor to inject malicious scripts usually browser side which are executed by end user while browsing.
These malicious scripts can but not limited to access/steal cookies, session tokens, sensitive data retained by browser.
Types of XSS:
1. Reflected XSS (Non-persistent Type I):
Reflected XSS occurs when user input is immediately returned by a web application in an error message, search result, or any other response that includes some or all of the input provided by the user as part of the request, without that data being made safe to render in the browser, and without permanently storing the user provided data
2. Stored XSS (Persistent Type II):
Stored XSS generally occurs when user input is stored on the target server, such as in a database, in a message forum, visitor log, comment field, etc. And then a victim is able to retrieve the stored data from the web application without that data being made safe to render in the browser. With the advent of HTML5, and other browser technologies, we can envision the attack payload being permanently stored in the victim’s browser, such as an HTML5 database, and never being sent to the server at all
3. DOM based XSS (Type-0):
DOM Based XSS (or as it is called in some texts, “type-0 XSS”) is an XSS attack wherein the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment
Server Side Request Forgery (SSRF) - this vulnerability allows attacker to abuse the functionality on the server to read or update internal resources.
The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.
SQL Injection - this attack consists of insertion or “injection” of a SQL query via the input data from the client to the application.
A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands
Local File Inclusion (LFI) - is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application.
This vulnerability occurs, for example, when a page receives, as input, the path to the file that has to be included and this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected.
Bypass vulnerability - this can allow a threat actor to bypass certain restrictions in the code
Remote Code Execution (RCE - Code Injection) - this vulnerability allows a threat actor to execute arbitrary code in the programming language in which the developer wrote that application.
The term remote means that the attacker can do that from a location different than the system running the application. This type of vulnerability can range from very hard to find to easy to find in the code.
