CWICP key terms

A desynchronization attack where mismatched Content-Length and Transfer-Encoding headers cause a front-end proxy and back-end server to disagree on request boundaries, letting an attacker prepend hidden requests to another user's traffic.

An HTTP header declaring how the message body is chunked for transport. Ambiguous or duplicated values, or mixing it with Content-Length, enable request smuggling and response splitting between intermediaries.

The browser rule that scripts from one origin cannot read responses or access DOM data belonging to a different scheme, host, or port. It is the foundation of client-side isolation, not an access control mechanism for servers.

Weak Cross-Origin Resource Sharing settings, such as reflecting arbitrary Origin values or allowing credentials with wildcard origins, that let hostile sites read authenticated responses the same-origin policy should have blocked.

Injecting crafted input so a shared cache stores a malicious response and serves it to other users. Often chained with header confusion or unkeyed inputs the cache ignores when building its cache key.

Gathering information about a target without directly touching its systems, using public sources such as certificate transparency logs, DNS records, search engines, and code repositories. It reduces detection risk.

Discovering hostnames belonging to a target through certificate transparency logs, DNS brute forcing, zone transfer attempts, and search engine results, expanding the attack surface beyond the primary application.

A replication mechanism where a primary DNS server sends its full record set to a secondary. If misconfigured to allow arbitrary clients, it discloses every hostname and internal address in the zone.

Building a profile of an organization from openly available data: employee names, technology stacks, email formats, leaked credentials, and infrastructure ranges. Feeds phishing, password spraying, and targeting decisions.

An attack where the tester forces a victim to use a session identifier known to the attacker, then hijacks the authenticated session. Prevented by issuing a fresh identifier at login and rejecting client-supplied ones.

The unpredictability of a session identifier, measured in bits. Tokens generated from weak PRNGs, timestamps, or sequential counters can be guessed or brute forced, enabling account takeover.

Flags controlling cookie behavior: Secure limits transmission to HTTPS, HttpOnly blocks script access, SameSite restricts cross-site sending, and Domain and Path scope where the cookie applies.

Trying a small set of common passwords against many accounts to avoid lockout thresholds. Effective because it stays under per-account failure limits while exploiting weak, reused credentials.

Replaying username and password pairs leaked from other breaches against a target, betting on password reuse. Differs from brute force because no guessing occurs; defenses include breached-password checks and MFA.

Weaknesses that defeat a second factor: response manipulation, missing verification on alternate endpoints, OTP brute force without rate limits, or backup code reuse. Testers check every authentication path, not just the primary one.

Accessing another user's records by changing an identifier in a request because the server checks authentication but not ownership. A form of broken object-level authorization common in APIs.

The API-centric name for failing to verify that the authenticated caller owns or may access the specific object referenced. Ranked among the most critical API risks because it bypasses otherwise sound authentication.

Gaining access to resources belonging to a peer with the same role, typically by manipulating identifiers. Contrasts with vertical escalation, which moves to a higher-privileged role.

Elevating from a lower-privileged role to an administrative one, often through forced browsing to admin endpoints, mass assignment of role fields, or missing server-side role checks.

Binding user-supplied request fields directly onto internal objects, letting an attacker set properties like isAdmin or accountBalance that the developer never intended to expose.

Inserting SQL syntax through user input so it alters a query's logic, enabling data theft, authentication bypass, or command execution. Prevented with parameterized queries, not input filtering alone.

Injection where results are not returned directly, so the tester infers data through boolean true/false responses or deliberate time delays. Slower but equally damaging.

Payloads stored safely at input time but executed later when the stored value is reused in a dangerous context, such as a query, log parser, or admin dashboard.

Injecting template syntax into user input that the server later evaluates, potentially reaching the underlying language runtime and achieving remote code execution. Detected with arithmetic probes like {{7*7}}.

Passing shell metacharacters through input into an operating system command, letting an attacker run arbitrary programs on the host. Mitigated by avoiding shells and using argument-array APIs.

Persistent script injection saved server-side and executed in other users' browsers when they view the affected page, enabling session theft and actions performed as the victim.

Client-side script injection where tainted data from sources such as location.hash flows into dangerous sinks like innerHTML without server involvement, so server-side filters never see the payload.

A response header restricting which script, style, and frame sources a page may load. A strong policy with nonces mitigates XSS; weak policies with unsafe-inline or wildcards provide little protection.

Forcing a logged-in victim's browser to send a state-changing request to another site that relies on ambient cookies. Defenses include SameSite cookies, anti-CSRF tokens, and origin verification.

Overlaying or framing a target site invisibly so the victim's clicks trigger unintended actions. Countered with X-Frame-Options or a frame-ancestors Content Security Policy directive.

Tricking a cache into storing a personalized, authenticated page under a public URL by appending static-looking extensions, letting attackers retrieve other users' sensitive data from the cache.

Assessing protocol versions, cipher suites, certificate validity, and key exchange for weaknesses such as SSLv3, RC4, or missing forward secrecy. Tools like testssl.sh automate the checks.

A header instructing browsers to use HTTPS only for a domain for a set period, blocking downgrade and SSL-stripping attacks. Preloading extends protection to the first visit.

A flaw where distinct error responses to malformed ciphertext reveal decryption details, allowing byte-by-byte plaintext recovery. Historically devastating against CBC-mode encryption in cookies and tokens.

Response headers such as Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy that harden browser behavior. Their absence is a finding, but presence alone does not prove exploitability.

Using sequences like ../ to escape a web root and read or write files outside it. Exploitable when file paths are built from user input without canonicalization and allowlist checks.

Weak default settings: exposed admin consoles, directory listing, verbose errors, default credentials, or unnecessary services. A broad category covering server, framework, and cloud configuration.

Evading a web application firewall through encoding, case variation, comment insertion, parameter pollution, or payload fragmentation so the filter and the backend parse input differently.

Representing attack strings in alternate forms such as URL, double-URL, Unicode, or HTML entity encoding so signature-based filters miss them while the target still decodes and executes them.

A false positive flags benign traffic as malicious, harming usability; a false negative lets an attack through. Tuning a WAF trades one against the other, and testers document both when evaluating coverage.

The signed agreement defining scope, permitted techniques, testing windows, escalation contacts, and data handling before testing begins. Testing outside it is unauthorized access regardless of intent.

Reporting vulnerabilities privately to the vendor with enough detail to reproduce, allowing reasonable remediation time before any public discussion. Coordinated variants align publication dates with the vendor.

Prioritizing findings by combining likelihood and impact, often with CVSS plus business context. A high CVSS score on an unreachable internal host may rank below a medium flaw exposing customer data.

Actionable fixes in a report: the root cause, the specific change required, and verification steps. Concrete advice like parameterized queries outperforms generic instructions to sanitize input.