BSCP key terms

A vulnerability where attacker-supplied markup reaches a victim's browser and executes as script in the site's origin. Stored, reflected, and DOM-based variants differ in where the payload is persisted and which code path renders it.

Client-side script reads attacker-controlled data from a source such as location.hash or document.referrer and passes it to a dangerous sink like innerHTML or eval, so the payload never reaches the server.

In DOM taint analysis, a source is where untrusted data enters client-side code and a sink is a dangerous function or property that interprets it as code or markup. Finding a path between them proves exploitability.

Converting characters such as <, >, &, and quotes into entity references so browsers render them as text rather than markup. Context matters: it does not protect attributes that already break out of quoting or script blocks.

Applying the encoding appropriate to where data lands: HTML body, attribute value, JavaScript string, CSS, or URL. A single generic encoder is insufficient because each context has different metacharacters and escaping rules.

An HTTP response header that restricts which script, style, frame, and connection sources the browser will load. A strong policy mitigates XSS impact, but misconfigurations such as unsafe-inline or loose wildcards often leave it bypassable.

Techniques that defeat a Content Security Policy, including JSONP endpoints, open redirects on allowlisted hosts, unsafe-inline with base tags, or script gadgets in permitted libraries. Testing whether a policy is actually enforced matters as much as reading it.

Inserting SQL syntax through user input so the query structure changes. Union-based, error-based, boolean-blind, and time-blind techniques extract data depending on how much output or timing signal the application returns.

Exploitation where query results are not reflected, so the attacker infers data from true/false page differences or response delays. Boolean and time-based variants require careful baseline measurement to avoid false positives.

Payload is stored safely at input time but later concatenated into a query or command when read back, so the injection fires in a different code path. Testing must follow data through storage and later reuse.

A prepared statement where SQL structure is fixed and user values are bound as data, preventing them from altering syntax. Effective only when the value is bound rather than concatenated into the statement text.

Passing untrusted input into a shell so metacharacters like semicolons, pipes, or backticks run additional commands. Blind variants are confirmed with timing delays or out-of-band callbacks.

User input is evaluated as template syntax, letting the attacker run expressions in the template engine and often reach the underlying language runtime. Detection uses arithmetic probes such as ${7*7} to distinguish evaluation from plain reflection.

Breaking out of a restricted execution environment, such as a template engine's safe mode or a JavaScript vm context, to reach unrestricted language features. Often the step that turns expression evaluation into remote code execution.

An XML parser resolves attacker-defined external entities, enabling local file disclosure, server-side request forgery, or denial of service. Exploitable whenever parsing allows DTDs and resolves entities.

The server fetches a URL chosen by the attacker, reaching internal services, cloud metadata endpoints, or localhost-only interfaces. Filters are commonly bypassed with redirects, alternate IP encodings, or DNS rebinding.

Untrusted serialized data is reconstructed into objects, letting the attacker control class properties and trigger gadget chains during deserialization. Impact ranges from property injection to remote code execution depending on available libraries.

Missing or weak authorization checks let a user act on objects or functions beyond their privileges. Insecure direct object references change an identifier such as an account number and observe whether the server still enforces ownership.

Gaining permissions the current identity should not hold, either vertically to a higher role or horizontally to another user's resources. Often results from trusting client-supplied role fields or missing server-side checks.

A framework binds all submitted fields onto an object, so adding an unexpected parameter such as isAdmin=true changes protected properties. Detectable by comparing accepted parameters against those the UI exposes.

Supplying the same parameter multiple times or in multiple locations so different layers parse different values. Can bypass validation, alter business logic, or split what a filter sees from what the application uses.

Conflicting framing headers such as Content-Length and Transfer-Encoding cause a front-end and back-end server to disagree on request boundaries, letting an attacker prefix the next user's request. Requires precise timing and connection reuse.

Injecting content into a shared cache so other users receive the attacker's response. Depends on unkeyed inputs, such as certain headers, influencing the cached response while the cache key stays the same.

The application trusts the client-supplied Host header when building links or routing, enabling password-reset link poisoning, cache poisoning, or virtual-host confusion. Testing includes duplicate and absolute-form Host values.

A parameter controls a redirect target without validation, sending users to an attacker-chosen site. Frequently chained into OAuth token theft, SSRF filter bypass, and phishing that appears to originate from the trusted domain.

A third-party page causes the victim's browser to send an authenticated state-changing request. Defenses include unpredictable tokens, SameSite cookies, and origin checks; missing any one may leave a bypass.

A cookie attribute controlling whether it is sent on cross-site requests: Strict, Lax, or None. Lax still allows top-level GET navigations, so state-changing GET endpoints remain exposed.

A permissive Access-Control-Allow-Origin that reflects arbitrary origins together with credentials lets a malicious site read authenticated responses. Wildcard origins without credentials are less severe but still leak public data.

Input containing dot-dot-slash sequences escapes an intended directory to read or write files elsewhere. Bypasses include encoding, double encoding, and absolute paths when normalization happens after validation.

Circumventing extension, MIME, or content checks to upload an executable or dangerous file. Common tricks include alternate extensions, polyglot files, trailing characters, and content-type spoofing.

A small uploaded script that gives remote command execution through HTTP requests. Its presence converts a file upload or injection flaw into persistent interactive access to the server.

Abuse of intended workflows rather than parser or memory errors, such as negative quantities, skipped payment steps, or coupon reuse. Found by understanding what the application assumes users will do.

Concurrent requests exploit a gap between a check and the action that depends on it, allowing limits to be exceeded or state to be corrupted. Testing requires synchronized or parallel request delivery.

Confirming a vulnerability by making the target contact an external listener you control, via DNS or HTTP. Essential for blind injection, SSRF, and XXE where no direct response reveals success.

Burp's running log of every request and response passing through the proxy, including those from other tools. It is the primary record for reviewing traffic, filtering by scope, and replaying interesting requests.

A Burp tool for manually editing and resending a single request repeatedly while comparing responses. Used to confirm injection behavior, tune payloads, and measure timing differences precisely.

Burp's automated request tool that places payloads into marked positions and sends many variants. Attack types include sniper, battering ram, pitchfork, and cluster bomb, each varying how payload sets are combined.

A marked insertion point in an Intruder request template, delimited by section signs, where payloads are substituted. Correct placement and count determine which attack type is appropriate.

An Intruder attack type that tries every combination of payloads across multiple positions. Useful for username-password guessing but produces the largest request volume, so rate and scope must be controlled.

Burp's allowlist of in-scope hosts and paths controlling what appears in site map, proxy history, and automated scanning. Setting scope prevents accidental testing of third-party systems.

Burp's automated component that crawls and audits in-scope traffic for known issue classes. Results require manual verification because findings can be false positives or miss logic flaws.

Proxy rules that rewrite requests or responses on the fly, such as changing user-agent strings or forcing headers. Handy for persistent testing conditions without editing every request manually.

An external interaction server that records DNS and HTTP callbacks triggered by target systems. It provides the out-of-band channel needed to confirm blind SSRF, XXE, and injection vulnerabilities.

A Burp utility for encoding and decoding data in formats such as URL, base64, hex, and HTML. Useful for transforming payloads and inspecting obfuscated tokens found in traffic.

A Burp tool that highlights differences between two requests, responses, or arbitrary text. Helpful for spotting subtle changes in tokens, cookies, or error messages across privilege levels.

A Burp tool that collects tokens such as session identifiers and analyzes their randomness. Poor entropy indicates predictable tokens that could enable session hijacking or CSRF token bypass.

Burp's extension framework, supporting BApp store add-ons and custom code in Java, Python, or Ruby. Extensions add capabilities like custom scanners, encoders, or protocol support.