This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:Attack"
(→Work to be done here includes) |
|||
(15 intermediate revisions by 10 users not shown) | |||
Line 5: | Line 5: | ||
Attacks are the techniques that attackers use to exploit the vulnerabilities in applications. Attacks are often confused with vulnerabilities, so please try to be sure that the attack you are describing is something that an attacker would do, rather than a weakness in an application. | Attacks are the techniques that attackers use to exploit the vulnerabilities in applications. Attacks are often confused with vulnerabilities, so please try to be sure that the attack you are describing is something that an attacker would do, rather than a weakness in an application. | ||
− | + | All attack articles should follow the [[Attack template]]. | |
− | + | ==Examples:== | |
− | |||
− | |||
− | |||
− | + | *Brute Force: Is an exhaustive attack that works by testing every possible value of a parameter (password, file name, etc.) [[:Brute_force_attack|Brute_force_attack]] | |
+ | *Cache Poisoning: Is an attack that seeks to introduce false or malicious data into a web cache, normally via HTTP Response Splitting. [[:Cache_Poisoning|Cache_Poisoning]] | ||
+ | *DNS Poisoning: Is an attack that seeks to introduce false DNS address information into the cache of a DNS server, where it will be served to other users enabling a variety of attacks. (e.g., Phishing) | ||
− | + | Note: many of the items marked vulnerabilities and other places are really attacks. Some of the more obvious are: | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | Note: many of the items marked vulnerabilities | ||
− | |||
− | |||
* [[Resource exhaustion]] | * [[Resource exhaustion]] | ||
− | |||
* [[Reflection injection]] | * [[Reflection injection]] | ||
* [[Reflection attack in an auth protocol]] | * [[Reflection attack in an auth protocol]] | ||
− | |||
[[Category:Article Type]] | [[Category:Article Type]] |
Latest revision as of 19:30, 6 June 2016
This category is for tagging common types of application security attacks.
What is an attack?
Attacks are the techniques that attackers use to exploit the vulnerabilities in applications. Attacks are often confused with vulnerabilities, so please try to be sure that the attack you are describing is something that an attacker would do, rather than a weakness in an application.
All attack articles should follow the Attack template.
Examples:
- Brute Force: Is an exhaustive attack that works by testing every possible value of a parameter (password, file name, etc.) Brute_force_attack
- Cache Poisoning: Is an attack that seeks to introduce false or malicious data into a web cache, normally via HTTP Response Splitting. Cache_Poisoning
- DNS Poisoning: Is an attack that seeks to introduce false DNS address information into the cache of a DNS server, where it will be served to other users enabling a variety of attacks. (e.g., Phishing)
Note: many of the items marked vulnerabilities and other places are really attacks. Some of the more obvious are:
Subcategories
This category has the following 13 subcategories, out of 13 total.
A
D
E
I
P
R
S
Pages in category "Attack"
The following 73 pages are in this category, out of 73 total.
B
C
- Cache Poisoning
- Cash Overflow
- Code Injection
- Command Injection
- Comment Injection Attack
- Content Security Policy
- Content Spoofing
- Cornucopia - Ecommerce Website Edition - Wiki Deck
- CORS OriginHeaderScrutiny
- CORS RequestPreflighScrutiny
- Credential stuffing
- Cross Frame Scripting
- Cross Site History Manipulation (XSHM)
- Cross Site Tracing
- Cross-Site Request Forgery (CSRF)
- Cross-site Scripting (XSS)
- Cross-User Defacement
- Cryptanalysis
- CSV Injection
- Custom Special Character Injection