Security & Penetration Testing Glossary

Comprehensive definitions of web application security terms, vulnerabilities, and concepts.

A

  • Advanced Encryption Standard (AES) The most widely used symmetric encryption algorithm, providing secure encryption in 128, 192, or 256-bit key variants.
  • API Key Exposure When API keys or credentials are inadvertently revealed in public locations like code repositories, client-side code,...
  • Arbitrary File Read A vulnerability that allows attackers to read files from the server's filesystem they shouldn't access, exposing conf...
  • Arbitrary File Write A critical vulnerability allowing attackers to write files to arbitrary locations on the server, typically leading to...
  • Argon2 The current recommended password hashing algorithm, winner of the Password Hashing Competition, with configurable mem...

B

  • Banner Grabbing A reconnaissance technique collecting service identification strings that reveal software names, versions, and config...
  • bcrypt A password hashing function with built-in salt and configurable work factor, designed to be slow enough to resist bru...
  • Billion Laughs Attack A denial-of-service attack using nested XML entity definitions that exponentially expand into gigabytes of data, exha...
  • Blind SQL Injection A SQL injection technique where query results are not directly visible, requiring attackers to infer data by analyzin...
  • Blind SSRF An SSRF variant where the attacker cannot see the response content, requiring out-of-band techniques or timing analys...
  • Blind XXE An XXE variant where parsed data isn't reflected in responses, requiring out-of-band techniques like DNS or HTTP call...
  • Boolean-Based Blind SQL Injection A blind SQL injection technique where data is extracted by observing different application responses based on whether...
  • Broken Access Control A category of vulnerabilities where restrictions on authenticated users are not properly enforced, allowing access to...
  • Broken Object Level Authorization (BOLA) An API vulnerability where the application fails to verify user permissions before granting access to objects, allowi...
  • Burp Suite The industry-standard web security testing platform with proxy, scanner, and tools for intercepting, analyzing, and e...

C

  • Cache Key Manipulation Techniques exploiting how caches construct keys to achieve poisoning or deception, targeting unkeyed inputs and norma...
  • CBC Bit Flipping Attack An attack on CBC-mode encryption where modifying ciphertext bytes causes predictable changes in the next decrypted bl...
  • Certificate Pinning Bypass Techniques to circumvent certificate pinning in mobile apps, allowing HTTPS traffic interception for security testing...
  • Cipher Block Chaining (CBC) An encryption mode where each plaintext block is XORed with the previous ciphertext block before encryption, hiding p...
  • Clickjacking An attack that tricks users into clicking hidden elements from another site by overlaying transparent iframes over de...
  • Code Injection A vulnerability that allows attackers to inject and execute arbitrary code within an application's runtime environmen...
  • Command Injection A vulnerability that allows attackers to execute arbitrary operating system commands on a server by injecting malicio...
  • Content Security Policy (CSP) A browser security mechanism that prevents XSS by specifying which content sources are allowed to load and execute on...
  • Cookie Security Flags Cookie attributes (HttpOnly, Secure, SameSite) that control browser handling, protecting against session hijacking, X...
  • Credential Stuffing An automated attack testing stolen credentials from data breaches against other websites, exploiting password reuse a...
  • Cross-Origin Resource Sharing (CORS) A mechanism allowing servers to specify which origins can access their resources, relaxing Same-Origin Policy. Miscon...
  • Cross-Site Request Forgery (CSRF) An attack that tricks authenticated users into performing unintended actions on a web application by exploiting the b...
  • Cross-Site Script Inclusion (XSSI) A vulnerability where sensitive data in JavaScript format can be stolen through cross-origin script inclusion, bypass...
  • Cross-Site Scripting (XSS) A client-side code injection attack where malicious scripts are injected into trusted websites, executing in victims'...
  • Cryptographic Nonce A number used only once in cryptographic communication to prevent replay attacks and ensure each encryption operation...
  • CSRF Token A unique, unpredictable value included in forms or requests that the server validates to ensure the request originate...
  • CVE (Common Vulnerabilities and Exposures) A publicly available list of disclosed cybersecurity vulnerabilities, each with a unique identifier (CVE-YYYY-NNNNN) ...
  • CVSS (Common Vulnerability Scoring System) A scoring system providing numerical ratings (0-10) for vulnerability severity based on attack characteristics and im...
  • CWE (Common Weakness Enumeration) A categorized list of software weakness types (like XSS, SQLi) that cause vulnerabilities, providing a taxonomy for d...

D

  • Deserialization Gadget Chain A technique for exploiting deserialization by chaining existing code fragments in libraries to achieve code execution...
  • Directory Bruteforcing A reconnaissance technique discovering hidden web directories and files by systematically requesting paths from wordl...
  • Directory Traversal A vulnerability allowing attackers to navigate outside intended directories to access arbitrary files using path mani...
  • Django ORM Leak Vulnerabilities where Django ORM field lookups can be manipulated to leak sensitive data through startswith filters, ...
  • DNS Rebinding An attack exploiting DNS to bypass Same-Origin Policy, allowing malicious websites to access internal network resourc...
  • Document Type Definition (DTD) A set of declarations defining XML document structure and entities. DTD entity features enable XXE attacks when exter...
  • DOM Clobbering A technique where HTML elements with id or name attributes overwrite JavaScript variables or DOM properties, potentia...
  • DOM-based XSS An XSS attack where the vulnerability exists in client-side JavaScript code that processes untrusted data and writes ...
  • Double Encoding URL-encoding characters twice to bypass filters that decode only once, allowing malicious payloads to be decoded by t...

E

  • ECB Mode Weakness A vulnerability in ECB encryption mode where identical plaintext blocks produce identical ciphertext blocks, revealin...
  • ECDSA (Elliptic Curve Digital Signature Algorithm) A digital signature algorithm using elliptic curve cryptography, providing equivalent security to RSA with significan...
  • EdDSA (Edwards-curve Digital Signature Algorithm) A modern digital signature scheme using Edwards curves, designed for high performance and resistance to implementatio...
  • Exploit Chain A sequence of multiple vulnerabilities combined to achieve higher impact than any single vulnerability, often escalat...
  • Exploit Payload The code or data delivered by an exploit to achieve objectives like spawning shells, establishing backdoors, or exfil...
  • Expression Language Injection A class of vulnerabilities where attackers inject code into expression languages (like JSP EL, SpEL, or OGNL) used by...

F

  • ffuf A fast web fuzzer for directory discovery, parameter brute-forcing, and virtual host enumeration with powerful filter...
  • Fingerprinting The process of identifying software, versions, and technologies used by a target to find known vulnerabilities and ta...

G

  • Gadget Chain A sequence of existing code fragments within an application that can be chained together during deserialization to ac...
  • Galois/Counter Mode (GCM) An authenticated encryption mode combining counter-mode encryption with Galois field authentication, providing both c...
  • GCM Nonce Reuse A critical vulnerability where reusing a nonce with the same key in AES-GCM encryption completely breaks confidential...
  • Gobuster A fast brute-forcing tool for directories, DNS subdomains, virtual hosts, and S3 buckets, written in Go.
  • Google Dorking Using advanced Google search operators to find sensitive information, exposed files, and vulnerable systems indexed b...
  • GraphQL Batching Attack Exploiting GraphQL's batch operation capability to bypass rate limiting, brute-force credentials in single requests, ...
  • GraphQL Injection Attack vectors targeting GraphQL APIs, including query manipulation, argument injection, and exploiting flexible quer...
  • GraphQL Introspection A GraphQL feature allowing schema queries that reveals all types, fields, and operations. Exposed in production, it a...

H

  • Hash Collision When two different inputs produce the same hash output, potentially allowing attackers to substitute one document for...
  • Hashcat The world's fastest GPU-accelerated password recovery tool, supporting hundreds of hash types and multiple attack modes.
  • HMAC (Hash-based Message Authentication Code) A cryptographic construction combining a hash function with a secret key to produce a message authentication code, ve...
  • Horizontal Privilege Escalation An access control vulnerability where a user can access resources belonging to another user at the same privilege level.
  • HTTP Request Smuggling A technique exploiting parsing discrepancies between front-end and back-end servers to smuggle hidden HTTP requests t...

I

  • Initialization Vector (IV) A random or pseudo-random value used with an encryption key to ensure identical plaintexts produce different cipherte...
  • Insecure Deserialization A vulnerability where untrusted data is used to abuse the logic of an application's deserialization process, potentia...
  • Insecure Direct Object Reference (IDOR) A vulnerability where user-supplied input directly references internal objects (files, database records) without prop...

J

  • John the Ripper A free, versatile password cracking tool with auto-detection, extensive format support, and powerful rule-based trans...
  • JSON CSRF A CSRF attack targeting endpoints that accept JSON content-type, often exploiting misconfigured CORS or content-type ...
  • JSON Web Encryption (JWE) A standard for encrypting JWT content, providing confidentiality in addition to the integrity protection offered by J...
  • JSON Web Signature (JWS) A standard for digitally signing JSON content, providing integrity protection and authentication for JWT payloads.
  • JSON Web Token (JWT) A compact, URL-safe token format for securely transmitting claims between parties, commonly used for stateless authen...
  • JSONP (JSON with Padding) A legacy technique for cross-origin data loading by wrapping JSON in callbacks. Deprecated due to security risks incl...
  • JWT Algorithm Confusion Attack An attack where the JWT verification algorithm is switched from asymmetric (RS256) to symmetric (HS256), using the pu...
  • JWT Key Confusion Attack An attack where the JWT verification process is tricked into using an incorrect key, often by exploiting how the libr...
  • JWT Kid Injection An attack exploiting the JWT "kid" (Key ID) header when it's used unsafely in database queries or file paths, enablin...
  • JWT None Algorithm Attack An attack exploiting JWT libraries that accept tokens with "alg": "none", allowing unsigned tokens to be treated as v...

L

  • LDAP Injection A vulnerability where user input in LDAP queries allows attackers to modify query logic, potentially bypassing authen...
  • Length Extension Attack An attack against Merkle-Damgård hash functions (MD5, SHA-1, SHA-256) that allows appending data to a message and com...
  • Local File Inclusion (LFI) A vulnerability where an application includes local files based on user input, allowing attackers to read sensitive f...
  • Log Poisoning An attack technique where malicious code is injected into log files, which are then included through an LFI vulnerabi...
  • Log4j JNDI Injection A critical vulnerability in Apache Log4j (Log4Shell) allowing remote code execution through JNDI lookup injection in ...

M

  • Man-in-the-Middle (MITM) An attack where the adversary intercepts communications between two parties, enabling eavesdropping, data modificatio...
  • Mass Assignment A vulnerability where attackers can modify object properties they shouldn't have access to by including extra paramet...
  • Metasploit A penetration testing framework with extensive exploit, payload, and post-exploitation modules for security testing a...
  • Mutation XSS (mXSS) An XSS variant that bypasses HTML sanitizers by exploiting browser parsing quirks, where benign-looking input mutates...

N

  • Node.js Prototype Pollution Prototype pollution in Node.js, where polluting Object.prototype can lead to remote code execution via child_process ...
  • NoSQL Injection An injection attack against NoSQL databases (MongoDB, CouchDB) using query operators like $ne, $gt, or $regex to bypa...
  • Nuclei A fast, template-based vulnerability scanner using YAML definitions, highly customizable with a large community templ...
  • Null Byte Injection Exploiting null byte (0x00) handling differences to truncate strings, bypass extension checks, or terminate paths pre...

O

  • OAuth2 An authorization framework that enables third-party applications to obtain limited access to user accounts without ex...
  • OAuth2 Access Token A credential issued by the authorization server that grants the client limited access to protected resources on behal...
  • OAuth2 Authorization Code Flow The most secure OAuth2 flow where the client receives an authorization code that is exchanged server-side for tokens,...
  • OAuth2 Authorization Server The OAuth2 component that authenticates users, obtains authorization, and issues access tokens to clients after succe...
  • OAuth2 Predictable State A vulnerability where the OAuth2 state parameter can be guessed or predicted, enabling attackers to forge valid autho...
  • OAuth2 Redirect URI The URL where the authorization server redirects users after authentication, carrying authorization codes or tokens b...
  • OAuth2 Refresh Token A long-lived credential used to obtain new access tokens without requiring user re-authentication, enabling persisten...
  • OAuth2 Resource Server The OAuth2 component that hosts protected resources and accepts access tokens to authorize API requests from clients.
  • OAuth2 State Fixation An attack where an attacker forces a victim to use a known OAuth2 state value, enabling the attacker to complete the ...
  • OAuth2 State Parameter A random value passed through the OAuth2 flow to prevent CSRF attacks by ensuring the callback originates from the sa...
  • OGNL Injection A code injection vulnerability targeting Apache Struts applications where attackers inject OGNL expressions to access...
  • Open Redirect A vulnerability where user-controlled input determines redirect destination, enabling attackers to redirect victims t...
  • Out-of-Band SQL Injection A SQL injection technique that exfiltrates data through alternative channels like DNS or HTTP requests, useful when d...
  • OWASP Top 10 A standard document listing the ten most critical web application security risks, published by OWASP and updated peri...
  • OWASP ZAP A free, open-source web security scanner from OWASP with proxy, automated scanning, and CI/CD integration capabilities.

P

  • Padding Oracle Attack A cryptographic attack exploiting information leaked through error messages about padding validity, enabling decrypti...
  • Password Salt Random data added to passwords before hashing, ensuring identical passwords produce different hashes and preventing r...
  • Password Spraying An attack trying common passwords against many accounts with delays between attempts, avoiding lockouts while maximiz...
  • Path Traversal A vulnerability that allows attackers to access files outside the intended directory by manipulating file paths with ...
  • PBKDF2 A key derivation function applying iterated HMAC to passwords. Widely supported but less GPU-resistant than bcrypt, s...
  • PHAR Deserialization A PHP vulnerability where accessing a PHAR archive file triggers automatic deserialization of its metadata, potential...
  • PHP A server-side scripting language widely used for web development, known for security considerations around type juggl...
  • PHP Object Injection A vulnerability where user input passed to PHP's unserialize() function allows attackers to inject objects that trigg...
  • PHP Type Juggling Vulnerabilities from PHP's loose type comparisons where automatic type conversion can lead to authentication bypasses...
  • PHP Wrappers PHP stream protocols (php://, data://, etc.) that extend file handling. When used with user input, they enable file r...
  • PKCE (Proof Key for Code Exchange) An OAuth 2.0 extension that prevents authorization code interception using a cryptographic challenge-response, requir...
  • PKCS#7 Padding A padding scheme that fills incomplete cipher blocks with bytes indicating the padding length, enabling block cipher ...
  • Polyglot Payload A single payload valid in multiple contexts or formats, triggering vulnerabilities regardless of how the application ...
  • postMessage Vulnerability Security issues from improper use of window.postMessage() for cross-origin communication, typically due to missing or...
  • Proof of Concept (PoC) Code or demonstration proving a vulnerability exists and is exploitable, validating security issues without full weap...
  • Prototype Pollution A JavaScript vulnerability where attackers modify Object.prototype, affecting all objects in the application and pote...
  • Python Pickle Python's serialization module that can execute arbitrary code during deserialization, making it dangerous for untrust...

R

  • Race Condition A vulnerability where concurrent operations exploit timing windows between security checks and actions, enabling doub...
  • Rails Mass Assignment A Rails vulnerability where user-submitted parameters can modify protected model attributes like admin flags when Str...
  • Rails Session Serialization Vulnerabilities from Rails session serialization using Marshal, which can lead to RCE if the secret_key_base is compr...
  • Rainbow Table A precomputed table of hash values used to reverse hashes back to plaintext, enabling fast password cracking when sal...
  • Reflected XSS A type of XSS where malicious script from the current HTTP request is reflected in the page response without proper s...
  • Remote File Inclusion (RFI) A vulnerability where an application includes and executes files from remote URLs based on user input, allowing execu...
  • Return-Oriented Programming (ROP) An exploitation technique chaining existing code sequences ending in return instructions to bypass non-executable mem...
  • RSA Cryptography A widely used asymmetric cryptography system based on the difficulty of factoring large prime numbers, used for encry...
  • Ruby Marshal Ruby's serialization mechanism that can execute code during deserialization through marshal_load or gadget chains in ...

S

  • Same-Origin Policy (SOP) A browser security mechanism that restricts how documents from one origin (protocol + host + port) can interact with ...
  • SAML Assertion A digitally signed XML document issued by an identity provider containing statements about a user's authentication st...
  • SAML Identity Provider (IdP) The trusted authority that authenticates users and issues SAML assertions to service providers in a single sign-on sy...
  • SAML NameID The unique identifier for a user within a SAML assertion, typically formatted as an email address, persistent ID, or ...
  • SAML Service Provider (SP) The application or service that relies on an identity provider for user authentication in a SAML-based single sign-on...
  • SAMLRequest An XML message sent by a service provider to an identity provider to initiate the authentication process for a user.
  • SAMLResponse An XML message containing the SAML assertion sent from the identity provider back to the service provider after succe...
  • scrypt A password hashing function designed to be memory-intensive, making brute-force attacks expensive on GPUs and special...
  • Security Assertion Markup Language (SAML) An XML-based open standard for exchanging authentication and authorization data between an identity provider and a se...
  • Server-Side Request Forgery (SSRF) A vulnerability where an attacker can make the server perform HTTP requests to arbitrary destinations, potentially ac...
  • Server-Side Template Injection (SSTI) A vulnerability where user input embedded into server-side templates allows attackers to inject template directives t...
  • Session Fixation An attack where the attacker fixes a user's session ID before authentication, then uses the same ID to access the vic...
  • Session Hijacking An attack where the attacker steals or captures a valid session token through XSS, network sniffing, or other means t...
  • Session Injection An attack injecting malicious data into session storage through insecure handling or deserialization, potentially lea...
  • SpEL Injection A code injection vulnerability where attackers inject Spring Expression Language (SpEL) expressions to access Spring ...
  • Spring Actuators Spring Boot endpoints exposing operational data. When unsecured, they can leak credentials, configuration, or enable ...
  • SQL Injection A code injection technique that exploits vulnerabilities in an application's database layer by inserting malicious SQ...
  • sqlmap An open-source tool automating SQL injection detection and exploitation, supporting data extraction, filesystem acces...
  • Stacked Queries A SQL injection technique where multiple SQL statements are executed in sequence by terminating the original query an...
  • Stored XSS A persistent XSS attack where malicious script is permanently stored on the target server (in a database, comment fie...
  • Struts DevMode A Struts development feature that exposes OGNL evaluation and debug capabilities, leading to code execution when enab...
  • Subdomain Enumeration The process of discovering subdomains through DNS queries, certificate logs, and brute forcing to find hidden service...
  • Subdomain Takeover A vulnerability where dangling DNS records point to deprovisioned cloud services, allowing attackers to claim the ser...
  • SVG XSS Cross-site scripting attacks that abuse SVG (Scalable Vector Graphics) elements, which can contain embedded JavaScrip...

T

  • Time-Based Blind SQL Injection A blind SQL injection technique that uses database time delay functions to infer data based on response time differen...
  • Timing Attack A side-channel attack that extracts secrets by measuring the time taken to perform cryptographic operations, exploiti...
  • TLS Stripping A man-in-the-middle attack that downgrades HTTPS connections to HTTP, allowing attackers to intercept encrypted traff...

U

V

  • Vertical Privilege Escalation An access control vulnerability where a lower-privileged user gains access to functions or data reserved for higher-p...

W

  • WAF Bypass Techniques to evade WAF detection using encoding, case manipulation, alternative syntax, and exploiting parsing diffe...
  • Web Application Firewall (WAF) A security solution that filters HTTP traffic to block common web attacks like XSS and SQL injection using signatures...
  • Web Cache Deception An attack that tricks caches into storing a victim's sensitive content by exploiting URL parsing differences between ...
  • Web Cache Poisoning An attack that manipulates cache behavior to store malicious responses served to other users, using unkeyed inputs th...
  • Wireshark The world's most popular network protocol analyzer for capturing and deeply inspecting network traffic in real-time o...

X

  • XML External Entity (XXE) A vulnerability in XML parsers where external entities can be defined to read local files, perform SSRF, or cause den...
  • XML Signature Wrapping An attack that exploits XML signature validation by moving or copying signed elements, tricking the application into ...
  • XPath Injection A vulnerability where user input in XPath queries allows attackers to manipulate query logic to access unauthorized d...
  • XS-Leak (Cross-Site Leak) A class of attacks that infer sensitive cross-origin information by exploiting browser side-channel behaviors like ti...
  • XSLT Injection A vulnerability where malicious content injected into XSLT stylesheets can lead to file disclosure, SSRF, or code exe...

Y

  • ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization using various gadget ...