CWLS flashcards
CWLS · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Broken access control
- A weakness where the server fails to enforce that the authenticated user is permitted to perform the requested action or read the requested object, allowing privilege escalation or data exposure.
- IDOR
- Insecure Direct Object Reference: an application exposes an internal object identifier and does not verify ownership, so changing the identifier returns another user's record.
- Parameterized query
- A database call where SQL structure is fixed at prepare time and user values are bound as data, preventing injected text from altering query logic.
- Stored XSS
- Persistent cross-site scripting where attacker-supplied script is saved server-side and executed in the browsers of users who later view the affected page.
- Context-aware output encoding
- Encoding untrusted data according to its sink, such as HTML entity encoding in element text versus JavaScript escaping inside a script block, so browsers treat it as data.
- Synchronizer token pattern
- A CSRF defense in which the server issues a per-session unpredictable token, embeds it in forms, and rejects state-changing requests lacking a matching token.
- SameSite cookie attribute
- A browser control limiting when cookies are sent on cross-site requests; Lax permits top-level navigation, Strict blocks cross-site sending, and None requires Secure.
- Session fixation
- An attack where the attacker predetermines a session identifier and the victim authenticates with it, so the attacker inherits an authenticated session unless the ID is rotated at login.
- SSRF
- Server-Side Request Forgery: the attacker induces the server to request an internal or attacker-chosen URL, potentially reaching metadata services or internal-only hosts.
- Insecure deserialization
- Processing untrusted serialized data without integrity checks, letting an attacker control object state or trigger gadget chains that execute code during reconstruction.
- Security misconfiguration
- Insecure default settings such as directory listing, verbose error pages, default credentials, unnecessary features, or missing hardening headers that widen the attack surface.
- Vulnerable component
- A library or framework version with known published vulnerabilities that remains in use because dependency inventory and patch cadence are absent.
- CVSS base score
- A 0.0 to 10.0 number derived from exploitability and impact metrics of a vulnerability; it excludes environmental and temporal context.
- CVSS severity bands
- None is 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, and Critical 9.0 to 10.0 in CVSS v3.1.
- Defense in depth
- Layering independent controls such as validation, parameterization, encoding, least privilege, and monitoring so that one failure does not directly yield compromise.
- Least privilege
- Granting each account, service, or process only the permissions required for its function, limiting blast radius when a component is compromised.
- Content-Security-Policy
- A response header restricting which script, style, frame, and network sources a page may load, reducing the impact of injected script when configured without unsafe-inline.
- HSTS
- Strict-Transport-Security instructs browsers to use HTTPS only for a host for a stated max-age, blocking downgrade attacks after the first secure visit.
- CORS misconfiguration
- Reflecting arbitrary origins in Access-Control-Allow-Origin while allowing credentials, which lets a hostile site read authenticated responses from the target.
- Password hashing
- Storing passwords with adaptive algorithms such as Argon2id or bcrypt plus a unique salt, making offline cracking costly; plain fast hashes are unsuitable.
- MFA bypass
- Any path that reaches an authenticated state without a second factor, such as a legacy endpoint, unvalidated OTP, or response manipulation that skips the challenge.
- Username enumeration
- Observable differences in timing or messages that reveal whether an account exists, enabling targeted credential attacks and account discovery.
- Business logic flaw
- A defect where syntactically valid requests violate intended workflow rules, such as negative quantities, skipped payment steps, or replayed coupons.
- Scope definition
- The written list of hosts, applications, accounts, and time windows authorized for testing; actions outside it are prohibited regardless of technical feasibility.
- Rules of engagement
- The engagement document specifying scope, allowed techniques, escalation contacts, testing windows, and constraints that govern how assessment activity is conducted.
- Proof of concept
- A minimal, reproducible request or sequence demonstrating a vulnerability's existence without causing harm beyond what is necessary to confirm it.
- False positive
- A reported finding that cannot be reproduced or that reflects expected behavior; it must be re-verified, isolated, and withdrawn or downgraded if unreproducible.
- Finding write-up
- A report entry containing title, asset, severity justification, description, reproduction evidence, business impact, and actionable remediation guidance for developers.
- Retest
- Re-executing the original proof of concept after a fix to confirm the defect is closed at the correct layer and no equivalent bypass remains.
- Rate limiting
- Throttling automated requests to avoid service disruption and to stay within agreed testing intensity; throttling also limits brute-force effectiveness.
- Security logging gap
- Insufficient recording or alerting on authentication and authorization events, which delays detection and prevents reconstruction of an intrusion timeline.
- Insecure design
- A class of weakness where the intended architecture lacks necessary controls, such as no server-side authorization model, so no implementation can be secure.