Wasc threat classification security threat Classification

For those who learn security knowledge for the first time, it is undoubtedly very important to learn the classification of security threats.

The webgoat project of OWASP also classifies some security issues, but its intention is to serve as an example of security learning, rather than being independently classified as security issues.

Web Application Security Consortium (wasc) is an international group composed of security experts, industry consultants, and representatives of many organizations. They are responsible for developing widely accepted application security standards for WWW. One of wasc's key projects is "Web security threat classification", which is "Threat classification ", that is, to describe the threats and attacks to web applications and classify them into common features. This project aims to develop and promote industry standard terms for security risks of Web applications. Wasc threat classification has been released to version 2.0, which has a lot more content than Version 1.0. The specific documents can be found at http://www.webappsec.org. (Some pages need to be turned over the wall ).

Copy these names from the official website.

Attacks	Weaknesses
Abuse of functionality	Application misconfiguration
Brute Force	Directory Indexing
Buffer Overflow	Improper filesystem Permissions
Content Spoofing	Improper input handling
Credential/session Prediction	Improper output handling
Cross-Site Scripting	Information Leakage
Cross-Site Request Forgery	Insecure Indexing
Denial of Service	Insufficient anti-Automation
Fingerprinting	Insufficient Authentication
Format String	Insufficient authorization
HTTP Response smuggling	Insufficient password recovery
HTTP Response Splitting	Insufficient process validation
HTTP Request Smuggling	Insufficient session expiration
HTTP request splitting	Insufficient transport layer protection
Integer Overflows	Server misconfiguration
LDAP Injection
Mail Command Injection
Null Byte Injection
OS commanding
Path Traversal
Predictable resource location
Remote File Transfer Sion (RFI)
Routing detour
Session Fixation
Soap array abuse
SSI Injection
SQL Injection
URL redirector abuse
XPath Injection
XML Attribute blowup
XML external entities
XML Entity Expansion
XML injection
XQuery Injection