AppSec & APIs
Definiciones en lenguaje claro del tema appsec & apis.
Broken function level authorisation (BFLA)
In API security, broken function level authorisation is a flaw where the API checks that a caller is authenticated but not that their role is permitted to invoke that particular operation. The endpoint exists, the token is valid, and an ordinary user reaches an administrative function simply by calling it.
Broken object level authorisation (BOLA)
In API security, broken object level authorisation (BOLA) is the failure to verify that the caller is entitled to the specific object their request names. It is the first entry in the OWASP API Security Top 10 and, in an API test, the flaw that most often exposes another tenant’s records.
Buffer overflow
A buffer overflow happens when a program writes more data into a temporary memory area than that area can hold, overwriting whatever sits next to it. It is one of the oldest ways to make a machine run somebody else’s instructions.
Business logic flaw
In application security, a business logic flaw is a defect in what the application permits rather than in how it is coded. Every request is well formed and every technical control works; the attacker simply uses the workflow in an order, quantity or combination the designers never considered, and the application agrees.
CAPTCHA
A CAPTCHA is a test designed to tell whether the thing on the other side of a form is a person or an automated program.
Clickjacking
Clickjacking is an attack in which a page the victim trusts is loaded invisibly inside a page the attacker controls, so a click aimed at the visible page is delivered to the hidden one. The victim performs a real, authenticated action without knowing which application received it.
Command injection
In application security, command injection is a flaw where user-controlled input reaches a system shell and is interpreted as part of the command line rather than as data. The attacker appends their own instructions to one the application intended to run, and the operating system executes both.
Content Security Policy (CSP)
In web security, Content Security Policy (CSP) is a response header that tells the browser which sources of script, style, frames and other resources a page is allowed to use. It is a containment control: it does not stop an injection happening, it limits what the injected content is permitted to do.
Cookie security attributes
Cookie security attributes are the flags a server sets alongside a cookie to constrain how the browser stores and sends it. In application security the ones that matter are Secure, HttpOnly and SameSite, plus the Domain and Path scope and the __Host- and __Secure- name prefixes that make the scope enforceable.
CORS misconfiguration
In API and web security, a CORS misconfiguration is a set of cross-origin resource sharing headers that grants a hostile website permission to read authenticated responses from your service. CORS relaxes the same-origin policy; configured wrongly it removes the boundary that keeps one site’s script out of another site’s data.
Cross-site request forgery (CSRF)
In web application security, cross-site request forgery (CSRF) is an attack that makes a logged-in user’s browser send a state-changing request to a site that trusts their session cookie. The user does not have to click anything on the target site: the request rides on credentials the browser attaches automatically.
Cross-site scripting (XSS)
In web application security, cross-site scripting (XSS) is a flaw that lets an attacker run their own JavaScript in another user’s browser, inside the trust boundary of your site. The browser cannot tell the injected script from yours, so the script inherits that user’s session, their cookies and everything the application lets them do.
Insecure deserialisation
In application security, insecure deserialisation is a flaw where an application rebuilds objects from data an attacker controls, and the rebuilding itself runs code. The attacker does not supply a payload the application will later interpret: the act of reading the input is the exploitation.
Insecure direct object reference (IDOR)
In web and API testing, an insecure direct object reference (IDOR) is a flaw where the application takes an identifier straight from the request and uses it to fetch or change a record without checking that the caller owns it. Changing one number in a URL returns somebody else’s data.
Open redirect
An open redirect is a flaw where an application sends the visitor to a URL taken from a parameter without checking it against a list of permitted destinations. On its own it leaks nothing, which is why it is often dismissed; its value to an attacker comes from what it is chained to.
OWASP API Security Top 10
In API security, the OWASP API Security Top 10 is a separate awareness list covering the weaknesses that appear specifically in application programming interfaces. It exists because APIs fail differently from web pages: the object graph is exposed directly, and most of the entries are authorisation problems rather than injection problems.
OWASP Top 10
In application security, the OWASP Top 10 is a periodically updated awareness document listing the categories of web application weakness that the project considers most important. It is a set of categories to be aware of, published by a non-profit foundation. It is not a standard, a certification, or a test scope.
Race condition
In application security, a race condition is a flaw where the result depends on the order in which concurrent requests are processed, because a check and the action it authorises are not atomic. Sending the same request many times in parallel makes the application act on state it has already invalidated.
Rate limiting
In application and API security, rate limiting is the control that caps how many requests a client may make in a window, so that guessing attacks, enumeration and abuse cost the attacker time. It does not decide whether a request is allowed: it decides how often the question can be asked.
Remote code execution (RCE)
In offensive security, remote code execution (RCE) is a flaw that lets an attacker run their own instructions on a target system across the network, without needing an account on that system. It is the outcome that other classes of bug lead to, and the finding that decides the severity of a report.
SAST
In application security, SAST is static application security testing: analysing source code, bytecode or binaries for weaknesses without running the software. It reads the code the way a compiler does, tracing how data moves from where it enters to where it is used, and reports the paths that look unsafe.
Server-side request forgery (SSRF)
In web and cloud security, server-side request forgery (SSRF) is a flaw where an attacker makes the application send an HTTP request of their choosing from its own network position. The request arrives with the server’s source address and its credentials, so it reaches internal services that were never meant to be exposed.
Server-side template injection (SSTI)
Server side template injection is a vulnerability in which user input is concatenated into a template that the server then renders, so the input is evaluated as template syntax rather than treated as data. Because template engines expose language objects, it usually escalates from expression evaluation to remote code execution.
Session fixation
In web application security, session fixation is an attack in which the attacker sets or learns a session identifier before the victim authenticates, and the application keeps that same identifier after login. The attacker then presents the identifier and is inside the authenticated session without ever knowing the password.
Session hijacking
In web and identity security, session hijacking is the theft and reuse of the token that proves a user has already logged in. The attacker never learns the password and never faces the login form: they present the stolen session and the application treats them as the user who created it.
Shadow API
A shadow API is an interface that is live and reachable but absent from the inventory the organisation defends: undocumented, forgotten after a migration, or left running from a version that was supposed to be retired. It is authenticated and monitored to whatever standard applied on the day it was built, which is usually none.
Software bug
A software bug is a defect in a program’s code that makes it behave differently from what was intended. It is not an attack and not a malicious act: it is an unintentional mistake. And it is where almost every vulnerability begins, unless that vulnerability comes from weak configuration or a stolen credential.
SQL injection
In application security, SQL injection is a flaw where input changes the meaning of a query the application builds, instead of being read as data inside it. Parameterised queries fix the common case, but identifiers such as table, column and sort order cannot be parameterised, and dynamic SQL inside stored procedures rebuilds the same problem.
STRIDE
STRIDE is a threat modelling mnemonic used in secure design reviews. It names six failure modes to reason about for each component of a system: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Each one is the negation of a security property the design is supposed to hold.
Subdomain takeover
In external testing, a subdomain takeover is what happens when a DNS record still points at a cloud or hosting resource that no longer exists, so anyone may register that resource and serve content from your domain name. The domain still resolves; the thing it resolves to now belongs to somebody else.