eWPTX key terms

A flaw where an attacker makes the server fetch a URL the attacker chooses, letting them reach internal services, cloud metadata endpoints, or loopback addresses that are hidden from outside users.

An internal HTTP address (for example 169.254.169.254) that returns instance credentials and configuration to anything running on the host. Reaching it via SSRF often yields temporary cloud keys.

Input checking that accepts only explicitly named values and rejects everything else. It is the reliable way to block SSRF and redirect abuse, unlike blocklists that miss alternate encodings.

An attack that abuses a parser resolving external entities in XML, allowing file disclosure, internal port probing, or server-side requests when entity expansion is enabled.

Passing serialized data that the application reconstructs into objects without integrity checks, letting an attacker control object state and often achieve remote code execution via gadget chains.

A sequence of existing classes and methods in an application's dependencies that, when invoked through controlled object properties, executes attacker-chosen code during deserialization.

An attack where payloads are stored safely at input time but later used unsafely in another query or command, so testing must follow data across features and requests.

Persistent script injection saved by the application and served to other users, executing in their browser context and enabling session theft or action forgery.

Client-side script injection where attacker-controlled data flows from a source such as location.hash into a dangerous sink like innerHTML without server involvement.

A response header restricting which script, style, and frame sources a browser may load. Weaknesses such as unsafe-inline or permissive JSONP hosts can let injected scripts run.

An attack that makes a logged-in victim's browser send a state-changing request to a target site, succeeding when the site relies on cookies alone without anti-CSRF tokens or origin checks.

A cookie attribute controlling whether the browser sends the cookie with cross-site requests. Lax and Strict modes reduce CSRF exposure, though they do not replace server-side tokens.

An access-control gap where changing an identifier in a request exposes another user's records because the server checks authentication but not object-level authorization.

Gaining access to resources belonging to a peer account at the same role level, typically by manipulating identifiers or parameters rather than elevating to an admin role.

Moving from a lower-privileged account to a higher role such as administrator by abusing missing role checks, forced browsing, or parameter tampering.

A vulnerability where the framework binds every submitted field to a model, letting an attacker set properties like role or isAdmin that the UI never exposes.

User input embedded in a server-side template is evaluated by the template engine, letting an attacker read variables and often escalate to arbitrary command execution.

An attack where no output is returned directly, so the tester infers success from timing delays, error differences, or out-of-band callbacks to a controlled listener.

Using an external listener to observe a target server making DNS or HTTP requests, confirming vulnerabilities such as blind SSRF, XXE, or command injection.

The highest-impact outcome in which an attacker runs arbitrary commands or code on the target host, typically the goal of injection and deserialization exploitation.

A small script uploaded to a compromised server that accepts commands over HTTP, giving persistent interactive control while blending in with legitimate web traffic.

Techniques to defeat upload restrictions, including double extensions, mismatched MIME types, magic-byte spoofing, and alternate filename encodings to place executable content on the server.

Injecting a payload into a response that a shared cache stores and serves to other users, achieved by exploiting unkeyed inputs the cache ignores when building its key.

Tricking a cache into storing a victim-specific authenticated response under a public URL, letting an attacker retrieve private data by requesting that cached path.

Desynchronizing front-end and back-end parsing of request boundaries, usually via conflicting Content-Length and Transfer-Encoding headers, to bypass controls or poison other users' requests.

An intermediary that forwards client requests to backend servers and often terminates TLS, normalizes headers, and enforces routing. Parsing differences with the backend enable smuggling.

A flaw where a server accepts a token signed with a different algorithm than intended, such as verifying an RS256 token with the public key as an HMAC secret.

A misconfiguration where the server accepts unsigned tokens declaring alg none, letting an attacker forge claims such as an administrator role without any key.

Reusing a captured or leaked session token or assertion to impersonate a user, effective when tokens are long-lived or lack binding to client context.

A timing flaw where concurrent requests exploit a gap between a check and the action it guards, enabling double spending, duplicate redemption, or privilege changes.

A weakness in intended workflow rather than code syntax, such as negative quantities, skipped steps, or price manipulation, which generic scanners rarely detect.

Any endpoint that reconstructs objects from client-supplied data, such as view-state, session blobs, or message queues, marking a high-value target for gadget-chain testing.

The written agreement listing which hosts, domains, and techniques are authorized, plus testing windows and exclusions. Exceeding it turns an assessment into unauthorized access.

The document setting constraints for a test: permitted attack types, escalation contacts, data-handling rules, and stop conditions that govern how findings are pursued.

Any system not explicitly authorized, including third-party SaaS, partner APIs, or sibling domains. Testing it, even incidentally, can breach contracts or law.

A minimal, reproducible demonstration of a vulnerability with request and response evidence, showing impact without causing harm or accessing more data than needed.

A reported finding that cannot be reproduced or has no real security impact. Confirming manually before reporting protects credibility and avoids wasted remediation effort.

A standardized scoring framework that rates vulnerabilities by exploitability and impact metrics, producing a numeric severity used to prioritize remediation across findings.

The sum of entry points an attacker can reach: URLs, parameters, APIs, file uploads, and exposed services. Mapping it early guides coverage during a time-boxed engagement.

Enumerating hidden paths, parameters, virtual hosts, and API routes using wordlists, crawling, and response analysis to expand the list of testable endpoints.