This subtree covers vulnerabilities that originate in the application code the development team controls: unsafe composition of queries and commands, broken authorization and access control, logic and workflow flaws, and misuse of frameworks. These would remain even if the web server and runtime were swapped for secure defaults, because the fault is in the source.
Server and reverse-proxy misconfiguration belong to the platform layer, and interpreter or engine bugs belong to the runtime layer; this section is for “same server, same runtime, vulnerable app code.”
Subtopics#
- Access control: Broken access control in server-side web code: endpoint, object, and property scope, plus trust toward headers and upstream systems.
- Authentication: An offensive guide to breaking how server-side code proves identity (credential, federated, MFA, session, and token handling) with the recon and attack metho...
- Identification: How application behavior reveals which accounts exist, eases credential stuffing, and exposes user identifiers, the pre-authentication recon that feeds accou...
- Injection: Untrusted data bound into something the server executes, parses, stores, renders, or requests, organized by the dangerous primitive under attack.
- Workflow: Business-logic and state integrity in multi-step and multi-service web flows: sequencing, concurrency, and parameter integrity.