OffSec Web Expert (OSWE): key terms

Flashcards for this exam OffSec Web Expert (OSWE) guide

• Burp SuiteA widely used web application security testing platform from PortSwigger built around an intercepting proxy.Intermediate
• Business Logic VulnerabilityA flaw in the design or workflow of an application that allows misuse of legitimate functionality.Intermediate
• Code InjectionA flaw in which input is evaluated as application code by the interpreter, such as through eval or dynamic includes.Intermediate
• Cross-Site WebSocket Hijacking (CSWSH)A CSRF-like attack in which a malicious site opens a WebSocket to a target using the victim's cookies.Advanced
• DOM-Based Cross-Site ScriptingXSS that occurs entirely in client-side JavaScript when it writes untrusted data from a source into a dangerous sink.Intermediate
• Gadget ChainA sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, performs unintended actions.Advanced
• Host Header InjectionAbuse of an application's trust in the HTTP Host header to poison links, caches or routing.Advanced
• HTTP Request SmugglingExploiting disagreement between front-end and back-end servers about where an HTTP request ends, to hide a second request.Advanced
• Insecure DeserializationDeserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.Intermediate
• JWT Algorithm ConfusionA JWT flaw where an attacker switches the token's algorithm (for example RS256 to HS256) so the server verifies it with the wrong key type.Advanced
• JWT None AlgorithmA JSON Web Token flaw where a library accepts tokens whose header specifies alg 'none', meaning no signature, allowing forged tokens.Advanced
• Limit OverrunA race condition in which parallel requests exceed a business limit, such as redeeming a coupon more than once.Advanced
• Mass AssignmentA vulnerability where a framework binds all request parameters to object properties, letting users set fields they should not control.Intermediate
• OWASP Web Security Testing Guide (WSTG)OWASP's comprehensive guide for testing the security of web applications and services, organized by test category with unique test IDs.Intermediate
• postMessage Origin ValidationChecking the origin of messages received through the browser's window.postMessage API before acting on them.Advanced
• Prototype PollutionA JavaScript vulnerability in which attacker input modifies Object.prototype, affecting all objects in the application.Advanced
• Second-Order SQL InjectionSQL injection in which malicious input is stored safely first and later used unsafely in another query.Advanced
• Server-Side Template Injection (SSTI)A vulnerability where user input is embedded into a server-side template as template code rather than data, potentially leading to remote code execution.Advanced
• Type JugglingUnexpected behavior from loosely typed comparisons, such as PHP's == operator, that can bypass authentication or checks.Advanced
• Unsafe ReflectionUsing user-controlled input to choose which classes or methods an application loads or invokes via reflection.Advanced
• Web Cache PoisoningCausing a cache to store a malicious response that is then served to other users.Advanced
• XML External Entity (XXE)A vulnerability in XML parsers that process external entity references, allowing file disclosure, SSRF or denial of service.Intermediate