BSCP flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Reflected XSS

The injected script is returned in the immediate response to the same request. It requires a victim to submit a crafted request and is delivered via links or forms.

Stored XSS

The payload is persisted server-side, such as in a database or log, and served to other users later. No crafted link is needed; any viewer of the page is attacked.

DOM-based XSS

The vulnerability exists entirely in client-side JavaScript. A source such as location.hash flows into a dangerous sink such as innerHTML, and the server never sees the payload.

CSRF prerequisites

A state-changing action, cookie-based session authentication, and absence of an unpredictable token or SameSite cookie protection. All three must hold for a CSRF attack to succeed.

IDOR

Insecure Direct Object Reference: a horizontal access-control flaw where changing an object identifier in a request returns another user's data or performs actions on their resources.

Blind SSRF

The server makes an outbound request to an attacker-controlled destination but does not return the response. Confirmation relies on out-of-band DNS or HTTP callbacks and timing differences.

Path traversal encoding

Servers may decode input after framework normalization, so test single-encoded, double-encoded, and overlong UTF-8 forms of dot-dot-slash to reach files outside the intended directory.

SQL injection union attack

Appends a UNION SELECT to the original query to retrieve data from other tables. It requires matching column count and compatible column types, determined by error probing or ordering.

Time-based blind injection

Infers data by measuring response delays triggered by conditional database functions. Each bit of information costs one request, so extraction is slow but works with no visible output.

Insecure deserialization

Attacker-controlled bytes reach a native deserializer such as Java ObjectInputStream or PHP unserialize. Gadget chains in loaded libraries convert object graph control into code execution.

File upload bypass checks

Test extension blacklist versus whitelist, content-type header trust, magic-byte validation, and storage path normalization. Server-side whitelist plus random rename and non-executable storage defeats most bypasses.

Vertical privilege escalation

A lower-privileged user reaches functionality reserved for a higher role. Test by replaying privileged endpoints with low-privilege credentials and by removing role parameters.

Horizontal privilege escalation

A user in one role accesses another user's resources at the same privilege level, typically by swapping object identifiers. It is the broader category that includes IDOR.

XXE injection

An XML parser resolves external entities supplied by the attacker. It can read local files, perform SSRF, or cause denial of service depending on parser configuration and entity expansion limits.

Open redirect

An application accepts a user-controlled destination parameter and redirects there without validation. It is chained with OAuth flows or phishing to lend the trusted domain's credibility.

SSTI

Server-side template injection occurs when user input is concatenated into a template and evaluated by the engine. Depending on engine, it escalates from data disclosure to remote code execution.

Burp Proxy scope

Setting target scope filters Proxy history, Repeater, and Scanner traffic. Out-of-scope hosts are excluded from automated scanning and from filtered Logger views, reducing noise.

Repeater purpose

Manual single-request iteration with full control over each byte and immediate response inspection. It is the tool for confirming a suspected vulnerability found by Proxy or Scanner.

Intruder Sniper

One payload set applied to one position at a time while other positions keep their base value. It is the default attack type for testing a single parameter.

Intruder Cluster bomb

Multiple payload sets, with every combination of payloads across all marked positions tested. It produces a cartesian product and is used when positions interact, such as username and password.

Intruder Pitchfork

Multiple payload sets iterated in parallel, one payload per set per request. It is used when payloads must stay paired, such as matching username and password lists.

Intruder Battering ram

A single payload set inserted into every marked position simultaneously. It is used when the same value must appear in multiple places, such as a token reflected twice.

Grep match rule

An Intruder setting that flags responses containing a specified string, such as an error message or success banner, making large result sets sortable by outcome.

Match and replace rule

A Proxy option that rewrites request or response headers and bodies in flight using literal or regex patterns. It is commonly used to inject auth headers globally.

Burp Scanner crawl vs audit

Crawl maps the application and discovers insertion points. Audit sends attack payloads to those points. Audit speed trades request rate against server stability and detection accuracy.

Burp Collaborator

An out-of-band interaction server that confirms blind vulnerabilities. A unique subdomain per payload lets you attribute DNS or HTTP hits to specific tests.

Comparer tool

Performs byte-level or word-level diffing between two requests or responses. It reveals boolean-based blind injection and access-control differences that single-response inspection misses.

Session handling macro

A recorded request sequence replayed to obtain fresh tokens or CSRF values. Session handling rules invoke macros on 401 or 403 responses or before requests during scans.

Repeater send to Comparer

Sends the current response to the Comparer tool for diffing against a baseline. It is the standard workflow for confirming subtle response differences during manual testing.

Burp Logger

A view of all tool traffic with filtering by scope, tool, and status. It is used to review requests after the fact and to confirm which payloads reached the target.

Proxy history filtering

Restricts displayed Proxy entries by scope, MIME type, status code, or search term. Filtering keeps large engagements manageable and prevents testing out-of-scope hosts.