OSWA key terms

The practice of finding unlinked files, directories, backup archives, and administrative panels on a web server by fuzzing wordlists against paths and comparing HTTP status codes, sizes, and redirect behaviour to spot valid resources.

Sending large numbers of candidate path names to a target and filtering responses by status code, response length, or timing so that hidden directories and files are revealed even when no links point to them.

Discovering additional sites served by the same IP address by sending requests with different Host header values and comparing responses; necessary because many internal applications share a single front-end server.

Identifying the server software, frameworks, and library versions in use by inspecting headers, cookie names, error pages, file extensions, and default assets, so that known vulnerabilities and attack paths can be selected.

Reading the robots.txt file to learn which paths the owner intended to hide from crawlers; Disallow entries frequently point to admin panels, staging areas, or backup directories that are valuable during enumeration.

Reviewing sitemap XML files and other crawler metadata to map an application's reachable URLs, including parameterised endpoints that are good candidates for injection testing.

Finding hidden or undocumented request parameters by mining JavaScript files, archived URLs, and API documentation, or by fuzzing parameter names, because unlinked parameters often reach less-tested server-side code.

Automated guessing of query, body, or JSON parameter names by sending candidate names and looking for changes in response length, status, or reflection, revealing parameters not visible in the rendered application.

Querying web archives such as the Wayback Machine and Common Crawl for historical URLs of a target, which often expose old endpoints, parameters, and files that are no longer linked from the live site.

Supplying a crafted Host header so the application generates links, password-reset URLs, or cache keys using attacker-controlled values, enabling cache poisoning, reset-link theft, or routing to internal virtual hosts.

Causing a shared cache to store a malicious response, typically by exploiting unkeyed inputs such as headers, so that other users receive the attacker's content; reconnaissance must identify which inputs the cache ignores when building its key.

Tricking a cache into storing a victim-specific, sensitive response under a static-looking URL so the attacker can later retrieve it, usually by appending a file extension the cache treats as static.

An attack where injected script is echoed back in the immediate response without being stored, executing in the victim's browser when they follow a crafted link or submit a crafted form, under the origin of the vulnerable site.

Injection where the malicious payload is persisted server-side, such as in a comment or profile field, and served to every user who views the affected page, requiring no crafted link and often affecting administrators.

A client-side flaw where JavaScript reads attacker-controlled data from a source such as location.hash and passes it to a dangerous sink such as innerHTML, so the payload never reaches the server.

In DOM XSS analysis, a source is where untrusted data enters client-side code (location, document.referrer, postMessage) and a sink is a dangerous function or property (innerHTML, eval, document.write) that executes or renders it.

Encoding characters such as angle brackets, quotes, and ampersands so injected data is treated as text rather than markup; correct escaping depends on whether the injection lands in element text, an attribute, a URL, or a script block.

Techniques for evading blacklist filters and weak sanitizers, including alternate encodings, unusual event handlers, tag and attribute case variation, and browser parsing quirks that differ from the filter's assumptions.

A bypass where a sanitizer's output is re-parsed by the browser into different markup, so a payload considered harmless by the filter becomes executable after the browser's own parsing and serialisation steps.

A response header restricting which script sources a page may load and whether inline script may run; a strong policy mitigates XSS, while weak policies with unsafe-inline, wildcards, or JSONP endpoints can often be bypassed.

Defeating a nonce-protected policy by reusing a nonce reflected on the page, abusing a script gadget in an allowlisted library, or injecting into a JSONP or base tag endpoint that the policy still trusts.

An attack that makes a logged-in victim's browser send a state-changing request to a site that trusts the victim's cookies, without the attacker being able to read the response; requires predicting all request parameters.

A random, unpredictable value tied to the user's session that must accompany state-changing requests; the server rejects requests lacking or mismatching the token, blocking forged submissions from other origins.

A cookie attribute controlling whether the cookie is sent on cross-site requests: Strict blocks all cross-site sends, Lax allows top-level GET navigations, and None allows all sends but requires the Secure flag.

Weaknesses where a CSRF token is not bound to the user session, is static across users, or is exposed through a GET response or referrer, letting an attacker obtain a valid token and complete a forged request.

Sending a forged request body in a format the CSRF defence does not expect, such as text/plain, multipart/form-data, or a URL-encoded body, so that the server still parses parameters while the protection is skipped.

Appending a UNION SELECT statement so the injected query returns extra rows in the original result set, letting the attacker read data from other tables; requires matching the column count and compatible data types.

Extracting data by forcing the database to emit error messages that contain query results or structural information, which is fast when verbose errors reach the client and the DBMS supports such functions.

Injection where no data or errors are returned directly, so the attacker infers information from boolean true/false responses or from deliberate time delays, one bit or one character at a time.

A blind technique that submits conditions such as AND 1=1 versus AND 1=2 and compares the resulting page content, length, or status to determine whether the condition evaluated true.

A blind technique that uses database-specific delay functions, such as SLEEP or pg_sleep, to make the response slow only when a tested condition is true, allowing data extraction even when page output never changes.

Determining the number and types of columns in the original query, using ORDER BY incrementing positions or UNION SELECT with increasing null counts, as a prerequisite for union-based extraction.

Identifying the backend database engine and version through version functions, error message wording, string concatenation syntax, and comment styles, which determines the payloads that will work.

An attack where the server is induced to make an HTTP or other request to a destination the attacker chooses, by supplying a URL to a feature such as an image fetcher, webhook, or PDF generator.

An internal address, commonly 169.254.169.254, that returns instance credentials and configuration to code running on the host; reaching it through SSRF can yield cloud account takeover.

Evading destination blocklists using alternate IP encodings, DNS names resolving to internal addresses, redirects, or URL parser discrepancies between the validation code and the HTTP client.

SSRF where the response body is not returned to the attacker, so confirmation and exploitation rely on out-of-band interaction, timing differences, or error messages observed on an attacker-controlled listener.

A technique where an attacker-controlled hostname first resolves to an external address to pass validation, then re-resolves to an internal address so the subsequent request reaches the internal network.

Supplying XML that defines external entities which the parser resolves, allowing file disclosure, internal HTTP requests, or denial of service when the parser has entity resolution enabled.

Document Type Definition, the section of an XML document that declares elements and entities; XXE payloads abuse the internal or external DTD subset to declare entities that reference files or URLs.

An entity declared with a percent sign and usable only inside a DTD; parameter entities enable out-of-band exfiltration and can reference external DTDs that contain further entity declarations.

XXE where extracted data is not reflected in the response, so the attacker uses external parameter entities to send file contents to a listener or triggers errors that leak information indirectly.

Confirming and exploiting a vulnerability by observing requests or DNS lookups arriving at an attacker-controlled server, used when in-band output is unavailable for SSRF, XXE, or blind injection.

A browser mechanism where a response's Access-Control-Allow-Origin header tells the browser whether cross-origin JavaScript may read the response; misconfiguration can expose authenticated data to hostile sites.

A CORS misconfiguration where the server echoes whatever Origin header it receives into Access-Control-Allow-Origin, which combined with credentials support lets any site read authenticated responses.

A CORS response header that permits the browser to expose a credentialed response to cross-origin script; when paired with a reflected or wildcard origin it turns a misconfiguration into data theft.

A server that accepts the literal Origin value null, which browsers send from sandboxed iframes and some redirect or file contexts, letting an attacker obtain a trusted cross-origin read.

An automatic OPTIONS request the browser sends before certain cross-origin requests to learn allowed methods and headers; the preflight response reveals the server's CORS policy during testing.

Injection of template syntax into user input that is later rendered by a server-side template engine, causing evaluation on the server and often leading to remote code execution.

Determining which template engine processes input by submitting polyglot arithmetic expressions and comparing the rendered output, since engines differ in syntax, evaluation order, and error messages.

Confirming SSTI by injecting a simple arithmetic expression such as a multiplication and observing the computed result in the response instead of the literal input, proving server-side evaluation.

Breaking out of a restricted template environment to reach underlying language objects and functions, typically by walking object attributes or using engine-specific globals, to achieve command execution.