GIAC Web Application Penetration Tester (GWAPT): key terms

Flashcards for this exam GIAC Web Application Penetration Tester (GWAPT) guide

• Allowlist ValidationInput validation that accepts only values matching a known-good pattern or set and rejects everything else.Foundational
• Android KeystoreAn Android system that stores cryptographic keys in a container that makes them hard to extract, often backed by secure hardware.Intermediate
• Android Network Security ConfigurationAn XML file that declares an Android app's network security settings, such as cleartext policy, trusted CAs and certificate pins.Advanced
• Anti-CSRF TokenA secret, unpredictable value tied to the user's session that must accompany state-changing requests, proving they originated from the application.Foundational
• Anti-TamperingControls that detect or resist modification of an application's code, resources or runtime behavior.Intermediate
• API DiscoveryAutomatically identifying an organization's APIs and endpoints from traffic, gateways, code and cloud configurations.Intermediate
• API Schema ValidationRejecting API requests and responses that do not conform to a defined schema such as OpenAPI or JSON Schema.Intermediate
• API Security TestingTesting APIs for authentication, authorization, input handling, rate limiting and business logic flaws, guided by the API specification.Intermediate
• App RepackagingDecompiling a legitimate app, modifying it (for example adding malware or removing checks), re-signing it and redistributing it.Intermediate
• App Transport Security (ATS)An iOS and macOS feature that requires apps to use HTTPS with strong TLS settings by default.Intermediate
• Authentication BypassGaining access to protected functions without valid credentials due to flaws in authentication logic.Intermediate
• Auto-Escaping TemplateA templating engine feature that automatically output-encodes variables for their context unless explicitly marked safe.Intermediate
• Blind Server-Side Request ForgerySSRF in which the attacker cannot see the response but can still make the server send requests.Advanced
• Blind SQL InjectionSQL injection where the application does not return query results or errors, so impact is inferred from behavior or timing.Intermediate
• Broken Access ControlOWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.Foundational
• Broken Authentication (API)API2:2023, weaknesses in API authentication mechanisms that let attackers assume other identities.Intermediate
• Broken Function Level Authorization (BFLA)API5:2023, failure to restrict access to administrative or privileged functions based on the caller's role.Intermediate
• Broken Object Level Authorization (BOLA)API1:2023, failure to verify that the caller is authorized to access the specific object identified in a request.Foundational
• Broken Object Property Level Authorization (BOPLA)API3:2023, failure to restrict which object properties a user can read or modify, combining excessive data exposure and mass assignment.Intermediate
• Burp SuiteA widely used web application security testing platform from PortSwigger built around an intercepting proxy.Intermediate
• Business Logic VulnerabilityA flaw in the design or workflow of an application that allows misuse of legitimate functionality.Intermediate
• CanonicalizationConverting data to its standard, simplest form before validating or using it.Intermediate
• CAPTCHAA challenge-response test intended to distinguish humans from automated bots.Foundational
• ClickjackingTricking a user into clicking something different from what they perceive by overlaying a transparent framed page.Foundational
• Client-Side ValidationInput checks performed in the browser or mobile app before data is sent to the server.Foundational
• Code InjectionA flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.Intermediate
• Code ObfuscationTransforming code to make it harder to read and reverse engineer while preserving its behavior.Intermediate
• Content Security Policy (CSP)An HTTP response header that tells browsers which sources of scripts, styles and other content are allowed, mitigating XSS and data injection.Intermediate
• Cookie PrefixesThe __Secure- and __Host- cookie name prefixes that make browsers enforce secure attributes on cookies.Advanced
• CORS MisconfigurationAn overly permissive CORS policy that lets untrusted origins read authenticated responses.Advanced
• CRLF InjectionInjection of carriage return and line feed characters into data used in protocol headers or logs.Intermediate
• Cross-Origin Opener Policy (COOP)An HTTP response header that isolates a page's browsing context group from cross-origin windows that open it or that it opens.Advanced
• Cross-Origin Resource Sharing (CORS)A browser mechanism using HTTP headers that lets a server allow specific other origins to read its responses.Intermediate
• Cross-Site Leaks (XS-Leaks)Browser side-channel attacks that infer a user's state on another site, such as whether they are logged in or a search returned results.Advanced
• Cross-Site Script Inclusion (XSSI)An attack in which a malicious page includes a target's authenticated script or JSON response via a script tag to read sensitive data.Advanced
• Cross-Site WebSocket Hijacking (CSWSH)A CSRF-like attack in which a malicious site opens a WebSocket to a target using the victim's cookies.Advanced
• Cryptographic FailuresOWASP Top 10 category for failures to protect data with appropriate cryptography, formerly called Sensitive Data Exposure.Foundational
• CSV InjectionEmbedding spreadsheet formulas in data that is later exported to CSV and opened in a spreadsheet application.Advanced
• Debug Mode in ProductionLeaving framework debug features, consoles or verbose diagnostics enabled on production systems.Foundational
• Deep Link HijackingAbuse of custom URL schemes or unverified links so a malicious app receives links intended for another app.Advanced
• Denylist ValidationInput validation that rejects values matching known-bad patterns and accepts everything else.Foundational
• Directory ListingA web server setting that displays a list of files in a directory when no index file is present.Foundational
• DNS RebindingA technique in which a domain's DNS answer changes between validation and use, so a host check passes but the request goes to an internal IP.Advanced
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Double-Submit CookieA stateless CSRF defense in which a random value is sent both in a cookie and in a request parameter or header, and the server checks they match.Advanced
• Excessive Data ExposureAn API flaw (API3:2019) where endpoints return more data than the client needs and rely on the client to filter it.Intermediate
• Exported Android ComponentAn Android activity, service, broadcast receiver or content provider that other apps can invoke.Advanced
• Forced BrowsingDirectly requesting URLs or resources that are not linked in the application, to find unprotected pages or files.Foundational
• Gadget ChainA sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, performs unintended actions.Advanced
• Google DorkingUsing advanced search engine operators to find sensitive information or vulnerable systems indexed by search engines.Foundational
• GraphQL IntrospectionA GraphQL feature that lets clients query the full schema, which can disclose sensitive types and operations in production.Intermediate
• GraphQL Query Depth LimitingRestricting how deeply nested or how costly a GraphQL query may be to prevent resource exhaustion.Advanced
• Host Header InjectionAbuse of an application's trust in the HTTP Host header to poison links, caches or routing.Advanced
• HTML SanitizationRemoving or neutralizing dangerous elements and attributes from user-supplied HTML while keeping safe formatting.Intermediate
• HTTP Request SmugglingExploiting disagreement between front-end and back-end servers about where an HTTP request ends, to hide a second request.Advanced
• HTTP Response SplittingAn attack using CRLF injection to make a server emit what a client or cache interprets as two separate HTTP responses.Advanced
• HTTP Security HeadersResponse headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.Intermediate
• HttpOnly Cookie AttributeA cookie flag that prevents client-side scripts from reading the cookie, reducing session theft via XSS.Foundational
• Idempotency KeyA unique client-supplied value that lets a server recognize repeated requests and perform an operation only once.Advanced
• Identification and Authentication FailuresOWASP Top 10 category for weaknesses in confirming user identity, authentication and session management.Foundational
• Improper Credential UsageMobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.Foundational
• Improper Inventory ManagementAPI9:2023, failure to track API hosts, versions and endpoints, leaving old, debug or undocumented APIs exposed.Intermediate
• InjectionOWASP Top 10 category for flaws where untrusted data is sent to an interpreter as part of a command or query.Foundational
• Input ValidationChecking that all untrusted input conforms to expected type, length, format and range before it is processed.Foundational
• Insecure Communication (Mobile)Mobile Top 10 risk (M5) where an app transmits data without strong transport security or validates certificates improperly.Foundational
• Insecure Data Storage (Mobile)Storing sensitive data on a mobile device in a way that other apps, backups or someone with physical access can read.Foundational
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• Insecure DesignOWASP Top 10 category for flaws rooted in missing or ineffective security controls at the design level rather than implementation bugs.Intermediate
• Insecure Direct Object Reference (IDOR)An access control flaw where an application exposes an internal object identifier and does not verify the user is authorized for that object.Foundational
• Insecure Password RecoveryWeak account recovery flows that let attackers reset other users' passwords.Intermediate
• Insecure RandomnessUsing a predictable random number generator for security-sensitive values such as tokens, keys or nonces.Intermediate
• Insufficient Binary ProtectionsMobile Top 10 2024 risk (M7) where app binaries lack protections against reverse engineering and tampering.Intermediate
• Interactive Application Security Testing (IAST)Security testing that uses agents instrumented inside a running application to observe code execution and data flow during functional tests.Intermediate
• Intercepting ProxyA tool that sits between a browser or app and a server to capture, inspect and modify HTTP(S) traffic.Foundational
• iOS KeychainApple's encrypted storage service for small secrets such as passwords, tokens and keys on iOS and macOS.Intermediate
• JWT Algorithm ConfusionA JWT flaw where an attacker switches the token's algorithm (for example RS256 to HS256) so the server verifies it with the wrong key type.Advanced
• JWT Claims ValidationChecking a JSON Web Token's standard claims, such as expiry, issuer and audience, in addition to its signature.Intermediate
• JWT None AlgorithmA JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.Advanced
• LDAP InjectionInjection that alters LDAP queries built from user input, potentially bypassing authentication or disclosing directory data.Intermediate
• Limit OverrunA race condition in which parallel requests exceed a business limit, such as redeeming a coupon more than once.Advanced
• Local File Inclusion (LFI)A vulnerability where an application includes or reads a local file whose path is controlled by user input.Intermediate
• Log InjectionWriting unvalidated user input to logs, allowing forged entries, log parsing exploits or injection into log viewers.Intermediate
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• Mobile App AttestationPlatform services that let a backend verify a request came from a genuine, unmodified app on a genuine device.Advanced
• Mobile Security Framework (MobSF)An open-source automated tool for static and dynamic security analysis of Android and iOS applications.Intermediate
• NoSQL InjectionInjection against NoSQL databases such as MongoDB, where crafted input alters query operators or logic.Intermediate
• OAuth Redirect URI ValidationRequiring an exact match between the redirect URI in an OAuth request and the URIs registered for the client.Advanced
• Open RedirectA flaw where an application redirects users to a URL supplied in a parameter without validation.Foundational
• OS Command Injection PreventionDefenses that prevent user input from being executed as operating system commands.Intermediate
• Out-of-Band Application Security Testing (OAST)Testing that detects blind vulnerabilities by observing callbacks, such as DNS or HTTP requests, from the target to a tester-controlled server.Advanced
• Output EncodingConverting untrusted data into a safe representation for the specific context where it is output, such as HTML, JavaScript, URL or SQL.Foundational
• OWASP AmassAn OWASP project tool for in-depth attack surface mapping and subdomain discovery.Intermediate
• OWASP API Security Top 10OWASP's list of the ten most critical security risks specific to APIs, last updated in 2023.Foundational
• OWASP Application Security Verification Standard (ASVS)An OWASP standard listing testable security requirements for web applications and services at three verification levels.Intermediate
• OWASP Cheat Sheet SeriesA collection of concise OWASP guides giving developers specific defensive guidance on individual security topics.Foundational
• OWASP Mobile Application Security Testing Guide (MASTG)OWASP's comprehensive manual of techniques and test cases for verifying mobile apps against MASVS.Intermediate
• OWASP Mobile Application Security Verification Standard (MASVS)OWASP's standard of security requirements for mobile apps, organized into control groups and verified with the MASTG.Intermediate
• OWASP Mobile Top 10OWASP's list of the ten most critical security risks for mobile applications, last updated in 2024.Foundational
• OWASP Secure Coding PracticesOWASP's technology-agnostic checklist of secure coding practices, originally the Secure Coding Practices Quick Reference Guide.Foundational
• OWASP Top 10OWASP's awareness document ranking the ten most critical web application security risk categories, updated every few years.Foundational
• OWASP Top 10 Proactive ControlsOWASP's list of the most important security techniques developers should apply in every project.Intermediate
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• Parameter TamperingModifying request parameters such as prices, quantities, IDs or hidden fields to change application behavior.Foundational
• Path Traversal PreventionDefenses that stop user input from accessing files outside an intended directory.Intermediate
• Permissions-PolicyAn HTTP header that controls which browser features, such as camera, microphone or geolocation, a page and its embedded frames may use.Intermediate
• postMessage Origin ValidationChecking the origin of messages received through the browser's window.postMessage API before acting on them.Advanced
• Prototype PollutionA JavaScript vulnerability in which attacker input modifies Object.prototype, affecting all objects in the application.Advanced
• Referrer-PolicyAn HTTP header controlling how much of the referring URL the browser sends in the Referer header.Intermediate
• Reflected Cross-Site ScriptingXSS in which a malicious script in a request is immediately echoed in the response without proper encoding.Foundational
• Refresh Token RotationIssuing a new refresh token each time one is used and invalidating the previous one, to limit the value of stolen tokens.Advanced
• Regular Expression Denial of Service (ReDoS)A denial of service caused by a regular expression that takes exponential time to evaluate certain inputs due to catastrophic backtracking.Advanced
• Remote Code Execution (RCE)The ability of an attacker to execute arbitrary code on a target system over a network.Foundational
• Remote File Inclusion (RFI)A vulnerability where an application includes and executes a file from a remote URL supplied by the user.Intermediate
• Reverse TabnabbingAn attack in which a page opened via a link with target=_blank uses window.opener to redirect the original tab to a phishing page.Advanced
• Root and Jailbreak DetectionMobile app checks that determine whether a device has been rooted (Android) or jailbroken (iOS), indicating weakened platform security.Intermediate
• Runtime Application Self-Protection (RASP)Security technology embedded in an application's runtime that detects and blocks attacks in real time using application context.Intermediate
• Same-Origin Policy (SOP)A browser security model that restricts scripts on one origin from reading data from another origin.Foundational
• SameSite Cookie AttributeA cookie attribute (Strict, Lax or None) controlling whether a cookie is sent with cross-site requests, mitigating CSRF.Intermediate
• Second-Order SQL InjectionSQL injection in which malicious input is stored safely first and later used unsafely in another query.Advanced
• Secure Code ReviewManual examination of source code to find security flaws, often focused on high-risk components and guided by checklists and tool output.Foundational
• Secure Cookie AttributeA cookie flag that instructs browsers to send the cookie only over HTTPS connections.Foundational
• Security Logging and Monitoring FailuresOWASP Top 10 category for insufficient logging, detection, alerting and response that allows breaches to go unnoticed.Foundational
• Security MisconfigurationOWASP Top 10 category for insecure default, incomplete or ad hoc configurations across the application stack.Foundational
• Server-Side Template Injection (SSTI)A vulnerability where user input is embedded into a server-side template as template code rather than data, potentially leading to remote code execution.Advanced
• Session FixationAn attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.Intermediate
• Session ID in URLPassing session tokens in URL query strings or paths, which exposes them in logs, history and Referer headers.Foundational
• Session InvalidationDestroying a session on the server so its identifier can no longer be used, such as at logout or password change.Foundational
• Session ManagementThe secure creation, maintenance and termination of user sessions after authentication.Foundational
• Session TimeoutAutomatic expiration of a session after inactivity (idle timeout) or after a maximum lifetime (absolute timeout).Foundational
• Session Token EntropyThe unpredictability of a session identifier, which must be high enough that guessing a valid one is infeasible.Intermediate
• Shadow APIAn API endpoint that is undocumented or unknown to the security team and therefore unmanaged.Intermediate
• Software and Data Integrity FailuresOWASP Top 10 category for code and infrastructure that do not protect against integrity violations, such as untrusted updates and insecure deserialization.Intermediate
• SQL Injection PreventionThe set of defenses that stop SQL injection, led by parameterized queries and supported by validation and least privilege.Foundational
• SSRF PreventionDefenses that stop an application from being used to send requests to unintended internal or external destinations.Intermediate
• Static Code Analysis Taint AnalysisA static analysis technique that tracks untrusted data from sources to dangerous sinks to find injection-type flaws.Advanced
• Stored Cross-Site ScriptingXSS in which a malicious script is saved by the application and later served to other users.Foundational
• Subdomain EnumerationDiscovering subdomains of a target domain to expand the known attack surface.Foundational
• Subdomain TakeoverGaining control of a subdomain whose DNS record points to a deprovisioned external resource, such as a deleted cloud bucket or app.Intermediate
• Subresource Integrity (SRI)A browser feature that verifies scripts or stylesheets loaded from third parties against a cryptographic hash in the HTML tag.Intermediate
• Timing AttackInferring secret information by measuring how long operations take.Advanced
• Trusted TypesA browser security API that forces dangerous DOM sinks to accept only typed, policy-approved values, preventing DOM-based XSS.Advanced
• Type JugglingUnexpected behavior from loosely typed comparisons, such as PHP's == operator, that can bypass authentication or checks.Advanced
• Unicode NormalizationConverting equivalent Unicode character sequences to a single standard form (NFC, NFD, NFKC or NFKD) before comparison or validation.Advanced
• Unrestricted Access to Sensitive Business FlowsAPI6:2023, exposure of a business flow (such as purchasing or posting) to automated abuse that harms the business, even without a code bug.Intermediate
• Unrestricted File UploadAllowing users to upload files without adequately validating type, content, name and size, which can lead to code execution or stored XSS.Foundational
• Unrestricted Resource ConsumptionAPI4:2023, APIs that do not limit the resources a request or client can consume, enabling denial of service or cost exhaustion.Intermediate
• Unsafe Consumption of APIsAPI10:2023, trusting data from third-party APIs more than user input, leading to injection, redirects or data exposure.Intermediate
• Username EnumerationDetermining which usernames or emails are valid from differences in an application's responses.Foundational
• Verbose Error MessageAn error message that reveals internal details such as stack traces, queries, file paths or software versions.Foundational
• Vulnerable and Outdated ComponentsOWASP Top 10 2021 category for using libraries, frameworks or platforms with known vulnerabilities or that are unsupported.Foundational
• Wayback MachineThe Internet Archive's service storing historical snapshots of websites, useful for finding removed content.Foundational
• Web Cache DeceptionTricking a cache into storing a victim's private, authenticated page by making it look like a static resource.Advanced
• Web Cache PoisoningCausing a cache to store a malicious response that is then served to other users.Advanced
• WebView SecuritySecure configuration of embedded browser components in mobile apps to prevent XSS escalation and data exposure.Advanced
• X-Content-Type-OptionsAn HTTP response header whose nosniff value stops browsers from MIME-sniffing a response away from its declared Content-Type.Intermediate
• X-Frame-Options (XFO)A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.Foundational
• XML BombA small XML document using nested entity expansion to consume huge amounts of memory and crash the parser.Advanced
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate
• XPath InjectionInjection that modifies XPath queries against XML data by inserting crafted input.Advanced
• ZAPAn open-source dynamic application security testing proxy and scanner, formerly OWASP ZAP and now maintained under Checkmarx sponsorship as ZAP by Checkmarx.Intermediate
• Zip BombA small compressed archive that expands to an enormous size to exhaust disk, memory or CPU during decompression.Advanced
• Zip SlipA path traversal vulnerability in archive extraction where entries with ../ in their names are written outside the target directory.Advanced
• Zombie APIA deprecated or retired API version that is still deployed and reachable.Intermediate