Threats, attacks & vulnerabilities
Application Attacks
Overview
Application attacks exploit weaknesses in websites, web applications, mobile apps, APIs, databases, and other software.
Key concepts
- Injection: SQL injection, command injection
- Client-side: XSS, CSRF
- Access & logic flaws: directory traversal, broken auth, IDOR, misconfiguration
- Execution & API: RCE, API attacks
How it works
Injection-based
| Type | What it does |
|---|---|
| SQL injection | Places malicious database commands into an application input field. |
| Command injection | Inserts malicious operating-system commands into an application input field. |
Client-side attacks
| Type | What it does |
|---|---|
| Cross-site scripting (XSS) | Injects malicious scripts into a trusted website, which then run in another user's browser. |
| Cross-site request forgery (CSRF) | Tricks a logged-in user's browser into performing an unwanted action on a trusted site. |
Access & logic flaws
| Type | What it does |
|---|---|
| Directory traversal | Attempts to access files or folders outside the intended application directory. |
| Broken authentication | A weakness in login, password, session, or identity-verification handling that can allow account compromise. |
| Insecure direct object reference (IDOR) | Changing an identifier in a request lets someone access another user's data. |
| Security misconfiguration | Insecure defaults, unnecessary features, excess permissions, or improperly configured services. |
Execution & API attacks
| Type | What it does |
|---|---|
| Remote code execution (RCE) | Lets an attacker run commands or code on another system — usually the most severe outcome. |
| API attack | Targets weaknesses in an API — weak authentication, exposed data, or missing access controls. |