For those who learn security knowledge for the first time, it is undoubtedly very important to learn the classification of security threats.
The webgoat project of OWASP also classifies some security issues, but its intention is to serve as an example of security learning, rather than being independently classified as security issues.
Web Application Security Consortium (wasc) is an international group composed of security experts, industry consultants, and representatives of many organizations. They are responsible for developing widely accepted application security standards for WWW. One of wasc's key projects is "Web security threat classification", which is "Threat classification ", that is, to describe the threats and attacks to web applications and classify them into common features. This project aims to develop and promote industry standard terms for security risks of Web applications. Wasc threat classification has been released to version 2.0, which has a lot more content than Version 1.0. The specific documents can be found at http://www.webappsec.org. (Some pages need to be turned over the wall ).
Copy these names from the official website.
Attacks |
Weaknesses |
Abuse of functionality |
Application misconfiguration |
Brute Force |
Directory Indexing |
Buffer Overflow |
Improper filesystem Permissions |
Content Spoofing |
Improper input handling |
Credential/session Prediction |
Improper output handling |
Cross-Site Scripting |
Information Leakage |
Cross-Site Request Forgery |
Insecure Indexing |
Denial of Service |
Insufficient anti-Automation |
Fingerprinting |
Insufficient Authentication |
Format String |
Insufficient authorization |
HTTP Response smuggling |
Insufficient password recovery |
HTTP Response Splitting |
Insufficient process validation |
HTTP Request Smuggling |
Insufficient session expiration |
HTTP request splitting |
Insufficient transport layer protection |
Integer Overflows |
Server misconfiguration |
LDAP Injection |
|
Mail Command Injection |
|
Null Byte Injection |
|
OS commanding |
|
Path Traversal |
|
Predictable resource location |
|
Remote File Transfer Sion (RFI) |
|
Routing detour |
|
Session Fixation |
|
Soap array abuse |
|
SSI Injection |
|
SQL Injection |
|
URL redirector abuse |
|
XPath Injection |
|
XML Attribute blowup |
|
XML external entities |
|
XML Entity Expansion |
|
XML injection |
|
XQuery Injection |
|