EC-Council Certified Application Security Engineer (CASE): key terms

Flashcards for this exam EC-Council Certified Application Security Engineer (CASE) guide

• API Schema ValidationRejecting API requests and responses that do not conform to a defined schema such as OpenAPI or JSON Schema.Intermediate
• API Security TestingTesting APIs for authentication, authorization, input handling, rate limiting and business logic flaws, guided by the API specification.Intermediate
• Broken Authentication (API)API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.Intermediate
• Broken Function Level Authorization (BFLA)API5:2023, failure to restrict access to administrative or privileged functions based on the caller's role.Intermediate
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Broken Object Property Level Authorization (BOPLA)API3:2023, failure to restrict which object properties a user can read or modify, combining excessive data exposure and mass assignment.Intermediate
• Common Weakness Enumeration (CWE)A community-developed catalog of software and hardware weakness types, maintained by MITRE.Intermediate
• CORS MisconfigurationAn overly permissive CORS policy that lets untrusted origins read authenticated responses.Advanced
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• CWE Top 25MITRE's annually updated ranking of the most dangerous software weaknesses, based on CVE data, severity and exploitation.Intermediate
• Excessive Data ExposureAn API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.Intermediate
• GraphQL IntrospectionA GraphQL feature that lets clients query the full schema, which can disclose sensitive types and operations in production.Intermediate
• GraphQL Query Depth LimitingRestricting how deeply nested or how costly a GraphQL query may be to prevent resource exhaustion.Advanced
• Improper Inventory ManagementAPI9:2023, failure to track API hosts, versions and endpoints, leaving old, debug or undocumented APIs exposed.Intermediate
• JWT Claims ValidationChecking a JSON Web Token's standard claims, such as expiry, issuer and audience, in addition to its signature.Intermediate
• JWT None AlgorithmA JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.Advanced
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• NoSQL InjectionInjection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.Intermediate
• OAuth Redirect URI ValidationRequiring an exact match between the redirect URI in an OAuth request and the URIs registered for the client.Advanced
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• Secure Software Development Life Cycle (SSDLC)A software development life cycle that builds security activities into every phase, from requirements and design through deployment and retirement.Foundational
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Unrestricted Access to Sensitive Business FlowsAPI6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.Intermediate
• Unrestricted Resource ConsumptionAPI4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.Intermediate
• Unsafe Consumption of APIsAPI10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.Intermediate
• White-Box TestingTesting with full knowledge of the target, including source code, architecture and credentials; called known-environment testing by CompTIA.Foundational