OSWE key terms

A code review technique that tracks untrusted input from where it enters a program to where it is used, revealing whether validation or sanitization happens before the value reaches a dangerous operation.

In data-flow analysis, a source is where attacker-controlled data enters, and a sink is a dangerous function that consumes data; a flaw exists when tainted data reaches a sink without adequate sanitization.

Enumerating every endpoint, parameter, header, cookie, and feature an application exposes so a tester knows where to probe for weaknesses before attempting exploitation.

Requesting guessed or wordlist-derived paths and filenames that are not linked in the interface, to find backups, admin panels, debug pages, or forgotten endpoints left accessible.

Automated submission of malformed, boundary, and special-character payloads to inputs while monitoring responses, status codes, and timing to identify parsing errors or injection points.

An access control weakness where an application uses a user-supplied identifier to fetch a record without verifying that the requester owns or may view that record.

Horizontal escalation lets one user act as a peer with equal rights; vertical escalation lets a lower-privileged user obtain administrative capabilities, often by manipulating roles, cookies, or hidden endpoints.

An attack where the tester forces a victim to use a session identifier known to the attacker; if the application does not issue a new identifier at login, the attacker reuses it to hijack the authenticated session.

Manipulating a JSON Web Token's header or key handling so the server verifies a signature with an unintended algorithm, such as accepting a token signed using the public key as an HMAC secret.

Defeating cross-site request forgery defenses by removing, duplicating, or predicting the token, or by exploiting endpoints that accept state-changing requests without validating it.

Supplying a forged Host header or similar value in a reset request so the generated recovery link points to an attacker-controlled domain, allowing theft of the reset token.

Appending a crafted UNION SELECT statement to an injectable query so the database returns extra rows, letting the attacker extract data from other tables through the application's normal output.

Extracting information from an injection point when query results are not displayed, by asking true or false questions and observing boolean response differences or time delays.

Inserting query operators such as $ne or $gt into JSON or parameter values so a NoSQL database evaluates attacker-chosen logic, commonly bypassing login checks.

Injecting filter metacharacters into directory queries to alter the search logic, potentially authenticating without valid credentials or enumerating directory entries.

Passing shell metacharacters into an application that builds an operating-system command from user input, causing additional attacker-supplied commands to execute on the server.

Persisting malicious script in server-side storage so it executes in the browsers of other users who later view the affected page, requiring no crafted link to be sent.

Script execution caused by client-side JavaScript reading attacker-controlled data from the URL or another browser source and writing it into a dangerous DOM sink.

Circumventing Content Security Policy restrictions by abusing allowed hosts, JSONP endpoints, script gadgets, or missing directives so injected JavaScript can execute.

Using injected JavaScript to read a page's anti-CSRF token and submit privileged requests as the victim, turning a script injection into unauthorized state-changing actions.

Supplying sequences such as ../ in a filename parameter so the resolved path escapes the intended directory, allowing reading or writing files elsewhere on the server.

An include or file-read parameter that accepts user input, letting an attacker load arbitrary local files such as configuration or credential files, and sometimes execute code through log poisoning.

A file inclusion vulnerability where the application fetches a remote URL supplied by the attacker, executing attacker-hosted code if remote includes are enabled.

Allowing users to upload files without adequate validation of type, content, or destination, enabling web shell placement or stored script execution.

Stream wrappers such as php://filter and data:// that can be used through file inclusion or file functions to read source code or supply payloads without writing a file.

Reconstructing objects from attacker-controlled serialized data, which can trigger dangerous methods or property manipulation during object creation and cleanup.

A sequence of existing classes with magic methods that, when triggered during deserialization, calls one another to reach a sensitive function such as command execution.

Injecting template syntax into user-controlled content that the server evaluates, allowing attackers to read variables, access internals, and often execute commands.

Making the server issue HTTP or other requests to a destination chosen by the attacker, reaching internal services, cloud metadata endpoints, or localhost-only interfaces.

Exploiting an XML parser that resolves external entities, causing it to read local files, perform network requests, or expand entities in denial-of-service attacks.

An XXE variant where extracted data is not returned in the response, so the attacker exfiltrates it through out-of-band DNS or HTTP requests to a controlled server.

A weakness in intended workflow rules rather than code syntax, such as skipping payment steps, reusing coupons, or manipulating quantities to gain unintended value.

Binding request parameters directly to object properties so an attacker can set fields the developer never intended to expose, such as role or account balance.

Exploiting the timing gap between a check and the action it protects, sending concurrent requests so a limit or balance is validated before being modified.

A custom program that automates request construction, payload delivery, and response parsing to reliably demonstrate or weaponize a discovered vulnerability.

Combining multiple lower-severity flaws, such as information disclosure plus injection plus file write, so their combined effect achieves a higher-impact objective.

A controlled server or DNS service that records interactions from the target, used to confirm blind vulnerabilities and exfiltrate data when responses are not visible.

A small script uploaded to a server that accepts commands through HTTP parameters, giving the attacker persistent remote command execution through the web server.

A parameter that sends users to an arbitrary external URL, abused for phishing or chained with authentication flows to leak tokens.