blitzstrike 2.4.100 → 2.4.102

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +25 -0
  2. package/dist/index.js +167 -1
  3. package/intelligence/attack_vectors.json +833 -830
  4. package/intelligence/techniques.json +1281 -1208
  5. package/package.json +1 -1
package/intelligence/attack_vectors.json CHANGED
@@ -1,832 +1,835 @@
1
1
  {
2
- "_comment": "Web attack vector taxonomy \u2014 master reference for attack-surface mapping (BLITZ tier). 34 categories of generic security terminology (OWASP/CWE-style attack vector names).",
3
- "version": 1,
4
- "categories": [
5
- {
6
- "id": "remote_code_execution",
7
- "title": "REMOTE CODE EXECUTION",
8
- "vectors": [
9
- "RCE / Remote Code Execution",
10
- "Command Injection",
11
- "OS Command Injection",
12
- "Code Injection",
13
- "Server-Side Template Injection / SSTI",
14
- "Unsafe Eval / Dynamic Code Execution",
15
- "File Upload to RCE",
16
- "Arbitrary File Write to RCE",
17
- "Log Poisoning to RCE",
18
- "PHAR Deserialization",
19
- "PHP Object Injection",
20
- "Java Deserialization RCE",
21
- "ImageMagick RCE",
22
- "GhostScript RCE",
23
- "Dependency-Based RCE",
24
- "Plugin / Module RCE"
25
- ],
26
- "focus": "Any sink that executes attacker-influenced code: eval/system, unserialize, template engines, deserialization. Test for direct exec; escalate via file write -> include -> exec."
27
- },
28
- {
29
- "id": "sql_database_attacks",
30
- "title": "SQL & DATABASE ATTACKS",
31
- "vectors": [
32
- "SQL Injection",
33
- "Blind SQL Injection",
34
- "Time-Based SQL Injection",
35
- "Boolean-Based SQL Injection",
36
- "Error-Based SQL Injection",
37
- "Union-Based SQL Injection",
38
- "Stacked Query Injection",
39
- "Second-Order SQL Injection",
40
- "NoSQL Injection",
41
- "MongoDB Injection",
42
- "ORM Injection",
43
- "GraphQL Database Injection",
44
- "Database Error Disclosure",
45
- "Exposed Database Service",
46
- "Database Misconfiguration"
47
- ],
48
- "focus": "SQL/NoSQL injection into queries. Test UNION, boolean, time-based, error-based; escalate via FILE privilege (INTO OUTFILE) or ORM bypass."
49
- },
50
- {
51
- "id": "authentication_session",
52
- "title": "AUTHENTICATION & SESSION",
53
- "vectors": [
54
- "Authentication Bypass",
55
- "Authorization Bypass",
56
- "Account Takeover / ATO",
57
- "Privilege Escalation",
58
- "Vertical Privilege Escalation",
59
- "Horizontal Privilege Escalation",
60
- "Session Hijacking",
61
- "Session Fixation",
62
- "Session Poisoning",
63
- "Cookie Injection",
64
- "Cookie Tossing",
65
- "JWT None Algorithm Attack",
66
- "JWT Key Confusion",
67
- "JWT Weak Secret",
68
- "JWT Expiration Missing",
69
- "JWT Replay Attack",
70
- "OAuth Misconfiguration",
71
- "SSO Misconfiguration",
72
- "SAML Misconfiguration",
73
- "OpenID Connect Misconfiguration",
74
- "MFA Bypass",
75
- "OTP Bypass",
76
- "Password Reset Poisoning",
77
- "Password Reset Token Leakage",
78
- "Password Reset Bypass",
79
- "Email Verification Bypass",
80
- "Weak Password Policy",
81
- "Credential Stuffing",
82
- "Brute Force Attack",
83
- "Password Spraying",
84
- "Account Enumeration",
85
- "Default Credentials",
86
- "Hardcoded Credentials",
87
- "Insecure Remember-Me Token",
88
- "Weak / Predictable Token",
89
- "Session Timeout Missing",
90
- "Concurrent Session Abuse"
91
- ],
92
- "focus": "Auth bypass, session fixation/hijacking, JWT misconfig (none alg, weak secret), cookie tampering, privilege escalation."
93
- },
94
- {
95
- "id": "access_control",
96
- "title": "ACCESS CONTROL",
97
- "vectors": [
98
- "Broken Access Control",
99
- "Missing Access Control",
100
- "IDOR / Insecure Direct Object Reference",
101
- "BOLA / Broken Object Level Authorization",
102
- "BFLA / Broken Function Level Authorization",
103
- "Broken Object Property Level Authorization",
104
- "Function-Level Access Control Bypass",
105
- "Object-Level Access Control Bypass",
106
- "Forced Browsing",
107
- "Insecure Direct Function Access",
108
- "Role Bypass",
109
- "Tenant Isolation Bypass",
110
- "Multi-Tenant Data Leakage",
111
- "Admin Panel Access Bypass",
112
- "Mass Assignment",
113
- "Quota Bypass",
114
- "Rate Limit Bypass",
115
- "CORS Misconfiguration"
116
- ],
117
- "focus": "IDOR, broken object-level auth, missing function-level access, path-based ACL bypass."
118
- },
119
- {
120
- "id": "file_path_attacks",
121
- "title": "FILE & PATH ATTACKS",
122
- "vectors": [
123
- "Path Traversal",
124
- "Directory Traversal",
125
- "LFI / Local File Inclusion",
126
- "RFI / Remote File Inclusion",
127
- "Arbitrary File Read",
128
- "Arbitrary File Download",
129
- "Arbitrary File Upload",
130
- "Unrestricted File Upload",
131
- "File Type Bypass",
132
- "MIME Type Bypass",
133
- "Double Extension Upload",
134
- "Zip Slip / Archive Traversal",
135
- "Archive Extraction Abuse",
136
- "Backup File Exposure",
137
- "Environment File Exposure",
138
- ".env Exposure",
139
- "Config File Exposure",
140
- "Repository Exposure",
141
- ".git Exposure",
142
- ".svn Exposure",
143
- "Directory Listing",
144
- "Temporary File Exposure",
145
- "Log File Exposure",
146
- "Sensitive File Disclosure"
147
- ],
148
- "focus": "Path traversal, LFI/RFI, arbitrary file read/write, upload path control."
149
- },
150
- {
151
- "id": "injection_attacks",
152
- "title": "INJECTION ATTACKS",
153
- "vectors": [
154
- "Insecure Deserialization",
155
- "Prototype Pollution",
156
- "XXE / XML External Entity Injection",
157
- "XPath Injection",
158
- "LDAP Injection",
159
- "CRLF Injection",
160
- "HTTP Response Splitting",
161
- "HTTP Parameter Pollution",
162
- "HTTP Request Smuggling",
163
- "Host Header Injection",
164
- "Header Injection",
165
- "Email Injection",
166
- "Email Header Injection",
167
- "HTML Injection",
168
- "CSV Injection",
169
- "Formula Injection",
170
- "Command Argument Injection",
171
- "Expression Language Injection",
172
- "OGNL Injection",
173
- "SpEL Injection",
174
- "Jinja2 Injection",
175
- "Freemarker Injection",
176
- "Velocity Injection"
177
- ],
178
- "focus": "Beyond SQL: LDAP, XPath, XML/XXE, CRLF, HTTP header injection, template injection."
179
- },
180
- {
181
- "id": "xss_client_side_attacks",
182
- "title": "XSS & CLIENT-SIDE ATTACKS",
183
- "vectors": [
184
- "Reflected XSS",
185
- "Stored XSS",
186
- "DOM-Based XSS",
187
- "Blind XSS",
188
- "Mutation XSS / mXSS",
189
- "Universal XSS",
190
- "Client-Side Template Injection",
191
- "DOM Clobbering",
192
- "postMessage Misconfiguration",
193
- "postMessage Origin Bypass",
194
- "CSP Misconfiguration",
195
- "CSP Bypass",
196
- "JSONP Abuse",
197
- "Script Gadget Abuse",
198
- "Source Map Exposure",
199
- "Sensitive Data in JavaScript",
200
- "Sensitive Data in LocalStorage",
201
- "Sensitive Data in SessionStorage",
202
- "Service Worker Abuse",
203
- "Web Worker Abuse",
204
- "Clickjacking",
205
- "UI Redressing"
206
- ],
207
- "focus": "Reflected/stored/DOM XSS, prototype pollution, client-side template injection, postMessage issues."
208
- },
209
- {
210
- "id": "csrf_redirect",
211
- "title": "CSRF & REDIRECT",
212
- "vectors": [
213
- "CSRF / Cross-Site Request Forgery",
214
- "Login CSRF",
215
- "Logout CSRF",
216
- "Stored CSRF",
217
- "Open Redirect",
218
- "Unvalidated Redirect",
219
- "OAuth Redirect URI Bypass",
220
- "SSO Redirect Abuse",
221
- "Clickjacking",
222
- "UI Redressing"
223
- ],
224
- "focus": "CSRF, open redirect, clickjacking, CORS misconfiguration."
225
- },
226
- {
227
- "id": "ssrf",
228
- "title": "SSRF",
229
- "vectors": [
230
- "SSRF / Server-Side Request Forgery",
231
- "Blind SSRF",
232
- "Semi-Blind SSRF",
233
- "Full-Read SSRF",
234
- "SSRF to Internal Network",
235
- "SSRF to Cloud Metadata",
236
- "SSRF to Localhost",
237
- "SSRF to Redis",
238
- "SSRF to Memcached",
239
- "SSRF via PDF Generator",
240
- "SSRF via Image Fetcher",
241
- "SSRF via Webhook",
242
- "SSRF via URL Preview",
243
- "DNS Rebinding",
244
- "Gopher-Based SSRF",
245
- "Cloud Metadata Exposure"
246
- ],
247
- "focus": "Server-side request forgery: internal port scan, cloud metadata, file read via URL schemes."
248
- },
249
- {
250
- "id": "api_security",
251
- "title": "API SECURITY",
252
- "vectors": [
253
- "BOLA / Broken Object Level Authorization",
254
- "BFLA / Broken Function Level Authorization",
255
- "Broken Object Property Level Authorization",
256
- "Excessive Data Exposure",
257
- "Mass Assignment",
258
- "Unrestricted Resource Consumption",
259
- "Unrestricted Access to Sensitive Business Flows",
260
- "Improper API Inventory Management",
261
- "Unsafe Consumption of APIs",
262
- "API Versioning Misconfiguration",
263
- "Deprecated API Exposure",
264
- "Shadow API Exposure",
265
- "Exposed Swagger / OpenAPI Docs",
266
- "Exposed GraphQL Endpoint",
267
- "GraphQL Introspection Exposure",
268
- "GraphQL Query Depth Abuse",
269
- "GraphQL Query Complexity Abuse",
270
- "GraphQL Batching Abuse",
271
- "GraphQL Alias Abuse",
272
- "GraphQL Field Suggestion Leakage",
273
- "REST API Misconfiguration",
274
- "WebSocket Misconfiguration",
275
- "WebSocket Authentication Bypass",
276
- "WebSocket Authorization Bypass"
277
- ],
278
- "focus": "REST/GraphQL: auth gaps, mass assignment, BOLA, rate limit, over-fetching."
279
- },
280
- {
281
- "id": "business_logic",
282
- "title": "BUSINESS LOGIC",
283
- "vectors": [
284
- "Business Logic Flaw",
285
- "Workflow Bypass",
286
- "Payment Bypass",
287
- "Price Manipulation",
288
- "Coupon Abuse",
289
- "Voucher Abuse",
290
- "Referral Abuse",
291
- "Reward Abuse",
292
- "Negative Quantity Abuse",
293
- "Race Condition in Checkout",
294
- "Inventory Manipulation",
295
- "Order Manipulation",
296
- "Cart Manipulation",
297
- "Discount Stacking Abuse",
298
- "Limit Bypass",
299
- "Quota Bypass",
300
- "Subscription Bypass",
301
- "Trial Abuse",
302
- "Refund Abuse",
303
- "Feature Access Bypass",
304
- "State Machine Bypass",
305
- "Improper Validation of Business Rules"
306
- ],
307
- "focus": "Logic flaws: price tampering, step skipping, race conditions on money/state transitions."
308
- },
309
- {
310
- "id": "race_condition",
311
- "title": "RACE CONDITION",
312
- "vectors": [
313
- "Race Condition",
314
- "TOCTOU / Time-of-Check to Time-of-Use",
315
- "Double Spending",
316
- "Concurrent Request Abuse",
317
- "Parallel Checkout Abuse",
318
- "Parallel Coupon Abuse",
319
- "Parallel Password Reset Abuse",
320
- "Parallel OTP Verification Abuse",
321
- "Account Balance Race",
322
- "Inventory Race",
323
- "File Operation Race"
324
- ],
325
- "focus": "TOCTOU, parallel request abuse, rate-limit race, session race."
326
- },
327
- {
328
- "id": "cache_cdn",
329
- "title": "CACHE & CDN",
330
- "vectors": [
331
- "Web Cache Poisoning",
332
- "Web Cache Deception",
333
- "Cache Key Confusion",
334
- "Cache Header Injection",
335
- "CDN Misconfiguration",
336
- "Origin Header Bypass",
337
- "Stale Cache Exposure",
338
- "Sensitive Data Cached",
339
- "Unauthenticated Cache Access",
340
- "Cache-Based Information Disclosure"
341
- ],
342
- "focus": "Cache poisoning/deception, CDN bypass to origin, host header poisoning."
343
- },
344
- {
345
- "id": "domain_dns",
346
- "title": "DOMAIN & DNS",
347
- "vectors": [
348
- "Subdomain Takeover",
349
- "Dangling DNS Record",
350
- "Dangling CNAME",
351
- "Dangling A Record",
352
- "Dangling NS Record",
353
- "Zone Transfer",
354
- "DNS Misconfiguration",
355
- "Wildcard DNS Abuse",
356
- "Domain Fronting Misconfiguration",
357
- "Expired Domain Takeover",
358
- "Email Domain Misconfiguration",
359
- "SPF Misconfiguration",
360
- "DKIM Misconfiguration",
361
- "DMARC Misconfiguration"
362
- ],
363
- "focus": "Subdomain takeover, dangling DNS, DNS rebinding, zone transfer."
364
- },
365
- {
366
- "id": "cloud_infrastructure_exposure",
367
- "title": "CLOUD & INFRASTRUCTURE EXPOSURE",
368
- "vectors": [
369
- "Exposed S3 Bucket",
370
- "Exposed Cloud Storage Bucket",
371
- "Public Blob Storage",
372
- "Cloud Metadata Exposure",
373
- "Exposed Kubernetes Dashboard",
374
- "Exposed Docker API",
375
- "Exposed Redis",
376
- "Exposed Memcached",
377
- "Exposed Elasticsearch",
378
- "Exposed MongoDB",
379
- "Exposed PostgreSQL",
380
- "Exposed MySQL",
381
- "Exposed Prometheus",
382
- "Exposed Grafana",
383
- "Exposed Kibana",
384
- "Exposed Jenkins",
385
- "Exposed GitLab",
386
- "Exposed Admin Panel",
387
- "Exposed Metrics Endpoint",
388
- "Exposed Debug Endpoint",
389
- "Exposed Actuator Endpoint",
390
- "Misconfigured Reverse Proxy",
391
- "Internal Service Exposure",
392
- "Open Management Port"
393
- ],
394
- "focus": "Exposed storage buckets, IAM misconfiguration, metadata service abuse, serverless misconfig."
395
- },
396
- {
397
- "id": "configuration_security_headers",
398
- "title": "CONFIGURATION & SECURITY HEADERS",
399
- "vectors": [
400
- "Security Misconfiguration",
401
- "Debug Mode Enabled",
402
- "Verbose Error Message",
403
- "Stack Trace Disclosure",
404
- "Default Installation Page",
405
- "Default Admin Panel",
406
- "Default Credentials",
407
- "Insecure HTTP Methods",
408
- "PUT Method Enabled",
409
- "TRACE Method Enabled",
410
- "CORS Misconfiguration",
411
- "Missing Security Headers",
412
- "Weak Security Headers",
413
- "HSTS Missing",
414
- "CSP Missing",
415
- "X-Frame-Options Missing",
416
- "X-Content-Type-Options Missing",
417
- "Referrer-Policy Missing",
418
- "Insecure TLS Configuration",
419
- "Weak Cipher Suites",
420
- "Expired SSL Certificate",
421
- "Mixed Content",
422
- "Directory Listing Enabled"
423
- ],
424
- "focus": "Missing/misconfigured security headers, debug endpoints, default credentials."
425
- },
426
- {
427
- "id": "cryptography_token",
428
- "title": "CRYPTOGRAPHY & TOKEN",
429
- "vectors": [
430
- "Weak Cryptography",
431
- "Broken Encryption",
432
- "Insecure Randomness",
433
- "Predictable Token",
434
- "Weak Token Generation",
435
- "Token Replay",
436
- "Token Leakage",
437
- "Token in URL",
438
- "JWT Weak Secret",
439
- "JWT Missing Expiration",
440
- "JWT Algorithm Confusion",
441
- "Hardcoded API Key",
442
- "Hardcoded Secret",
443
- "Secret Leakage in Frontend",
444
- "Secret Leakage in Repository",
445
- "Weak Password Hashing",
446
- "Plaintext Password Storage",
447
- "Insecure Key Management",
448
- "Sensitive Data Exposure via Logs"
449
- ],
450
- "focus": "Weak/guessable tokens, predictable reset, JWT/encryption key reuse, padding oracle."
451
- },
452
- {
453
- "id": "supply_chain",
454
- "title": "SUPPLY CHAIN",
455
- "vectors": [
456
- "Supply Chain Attack",
457
- "Dependency Confusion",
458
- "Dependency Hijacking",
459
- "Typosquatting Package",
460
- "Malicious Package Injection",
461
- "Compromised Package",
462
- "Outdated Dependency",
463
- "Vulnerable Dependency",
464
- "Composer Package Abuse",
465
- "NPM Package Abuse",
466
- "PyPI Package Abuse",
467
- "Maven Package Abuse",
468
- "Plugin Supply Chain Attack",
469
- "Theme Supply Chain Attack",
470
- "Third-Party Script Compromise",
471
- "CDN Script Compromise",
472
- "Subresource Integrity Missing"
473
- ],
474
- "focus": "Dependency confusion, malicious package, build pipeline injection."
475
- },
476
- {
477
- "id": "ci_cd_devops",
478
- "title": "CI/CD & DEVOPS",
479
- "vectors": [
480
- "CI/CD Secret Exposure",
481
- "Exposed GitHub Actions Secrets",
482
- "Exposed GitLab CI Variables",
483
- "Exposed Jenkins Credentials",
484
- "Build Artifact Exposure",
485
- "Public CI Logs",
486
- "Docker Image Secret Leakage",
487
- "Hardcoded Secrets in Container Image",
488
- "Insecure Deployment Pipeline",
489
- "Over-Permissioned CI Token",
490
- "Leaked SSH Key",
491
- "Leaked Cloud Key",
492
- "Leaked API Token",
493
- "Public Backup Artifact"
494
- ],
495
- "focus": "CI/CD secrets in pipeline, exposed build servers, Docker misconfiguration."
496
- },
497
- {
498
- "id": "information_disclosure",
499
- "title": "INFORMATION DISCLOSURE",
500
- "vectors": [
501
- "Information Disclosure",
502
- "Data Leakage",
503
- "Sensitive Data Exposure",
504
- "PII Exposure",
505
- "User Data Exposure",
506
- "Admin Data Exposure",
507
- "Source Code Disclosure",
508
- "Stack Trace Disclosure",
509
- "Error Message Disclosure",
510
- "Server Banner Disclosure",
511
- "Version Disclosure",
512
- "Internal IP Disclosure",
513
- "Internal Path Disclosure",
514
- "Debug Information Disclosure",
515
- "API Key Disclosure",
516
- "Access Token Disclosure",
517
- "Private Key Disclosure",
518
- "Backup Disclosure",
519
- "Log Disclosure",
520
- "Database Dump Exposure",
521
- "Source Map Disclosure"
522
- ],
523
- "focus": "Verbose errors, source/backup exposure, .git/.env leaks, debug info."
524
- },
525
- {
526
- "id": "dos_resource_abuse",
527
- "title": "DoS & RESOURCE ABUSE",
528
- "vectors": [
529
- "DoS / Denial of Service",
530
- "Application-Level DoS",
531
- "Resource Exhaustion",
532
- "CPU Exhaustion",
533
- "Memory Exhaustion",
534
- "Disk Exhaustion",
535
- "Large Payload DoS",
536
- "File Upload DoS",
537
- "Slowloris",
538
- "ReDoS / Regular Expression DoS",
539
- "XML Bomb",
540
- "Billion Laughs Attack",
541
- "Zip Bomb",
542
- "Decompression Bomb",
543
- "GraphQL Complexity DoS",
544
- "GraphQL Depth DoS",
545
- "Expensive Search Query DoS",
546
- "Pagination Abuse",
547
- "Connection Exhaustion",
548
- "Webhook Flooding"
549
- ],
550
- "focus": "Resource exhaustion, ReDoS, zip bomb, unbounded loops, expensive queries."
551
- },
552
- {
553
- "id": "mobile_hybrid_web",
554
- "title": "MOBILE & HYBRID WEB",
555
- "vectors": [
556
- "Deep Link Hijacking",
557
- "Universal Link Misconfiguration",
558
- "App Link Misconfiguration",
559
- "WebView JavaScript Bridge Abuse",
560
- "Insecure WebView Configuration",
561
- "Insecure App-to-Web Token Sharing",
562
- "Mobile OAuth Redirect Abuse",
563
- "Custom Scheme Hijacking",
564
- "Local File Access via WebView",
565
- "Insecure Deeplink Parameter Handling"
566
- ],
567
- "focus": "Mobile API exposure, insecure deep links, WebView JS bridge, hardcoded keys."
568
- },
569
- {
570
- "id": "third_party_integration",
571
- "title": "THIRD-PARTY INTEGRATION",
572
- "vectors": [
573
- "Webhook Misconfiguration",
574
- "Webhook SSRF",
575
- "Webhook Signature Bypass",
576
- "Payment Gateway Misconfiguration",
577
- "OAuth App Misconfiguration",
578
- "Third-Party API Key Leakage",
579
- "Third-Party Widget XSS",
580
- "Analytics Script Exposure",
581
- "Chat Widget Misconfiguration",
582
- "Email Service Misconfiguration",
583
- "Storage Integration Misconfiguration"
584
- ],
585
- "focus": "OAuth/SSO misconfiguration, webhook SSRF, payment/plugin callback abuse."
586
- },
587
- {
588
- "id": "email_account_communication",
589
- "title": "EMAIL & ACCOUNT COMMUNICATION",
590
- "vectors": [
591
- "Email Header Injection",
592
- "SMTP Misconfiguration",
593
- "Email Spoofing",
594
- "SPF Misconfiguration",
595
- "DKIM Misconfiguration",
596
- "DMARC Misconfiguration",
597
- "Password Reset Email Poisoning",
598
- "Verification Link Leakage",
599
- "Magic Link Leakage",
600
- "Account Enumeration via Email",
601
- "HTML Email Injection"
602
- ],
603
- "focus": "Email header injection, password reset via email, account recovery flaws."
604
- },
605
- {
606
- "id": "admin_management_panel",
607
- "title": "ADMIN & MANAGEMENT PANEL",
608
- "vectors": [
609
- "Exposed Admin Panel",
610
- "Default Admin Credentials",
611
- "Weak Admin Authentication",
612
- "Admin Path Disclosure",
613
- "Admin Function Access Bypass",
614
- "Unauthenticated Admin API",
615
- "Debug Console Exposure",
616
- "Developer Console Exposure",
617
- "Management Interface Exposure",
618
- "Internal Dashboard Exposure"
619
- ],
620
- "focus": "Exposed admin panels, default admin credentials, broken admin auth."
621
- },
622
- {
623
- "id": "modern_web_frameworks",
624
- "title": "MODERN WEB FRAMEWORKS",
625
- "vectors": [
626
- "Next.js Source Map Exposure",
627
- "Next.js Image Optimization SSRF",
628
- "Next.js Middleware Misconfiguration",
629
- "React Hydration Data Leakage",
630
- "Angular Template Injection",
631
- "Vue Template Injection",
632
- "Nuxt Misconfiguration",
633
- "Webpack Source Map Exposure",
634
- "Vite Dev Server Exposure",
635
- "Exposed Build Manifest",
636
- "Client-Side Route Access Bypass",
637
- "Frontend Feature Flag Abuse"
638
- ],
639
- "focus": "Framework-specific: Laravel debug/Ignition, Spring actuator, Django debug, Rails mass assignment."
640
- },
641
- {
642
- "id": "cms_plugin_theme",
643
- "title": "CMS, PLUGIN & THEME",
644
- "vectors": [
645
- "WordPress Plugin Vulnerability",
646
- "WordPress Theme Vulnerability",
647
- "Joomla Extension Vulnerability",
648
- "Drupal Module Vulnerability",
649
- "OJS Plugin Vulnerability",
650
- "OpenSID Module Vulnerability",
651
- "CMS Arbitrary File Upload",
652
- "CMS Authentication Bypass",
653
- "CMS SQL Injection",
654
- "CMS Stored XSS",
655
- "CMS RCE",
656
- "CMS Misconfiguration",
657
- "Outdated CMS Core",
658
- "Outdated Plugin",
659
- "Outdated Theme"
660
- ],
661
- "focus": "CMS vulnerabilities: WP plugins/themes, known CVEs, plugin upload, serialized options."
662
- },
663
- {
664
- "id": "server_platform_specific",
665
- "title": "SERVER & PLATFORM SPECIFIC",
666
- "vectors": [
667
- "PHP Object Injection",
668
- "PHP File Inclusion",
669
- "PHP Upload Bypass",
670
- "PHP Session Poisoning",
671
- "Laravel Debug Exposure",
672
- "Laravel Ignition RCE",
673
- "Laravel APP_KEY Exposure",
674
- "Symfony Profiler Exposure",
675
- "Spring Boot Actuator Exposure",
676
- "Spring Expression Injection",
677
- "Node.js Prototype Pollution",
678
- "Node.js Deserialization",
679
- "Express Misconfiguration",
680
- "Django Debug Exposure",
681
- "Flask Debug Console Exposure",
682
- "Ruby on Rails Secret Key Exposure",
683
- "ASP.NET ViewState Misconfiguration"
684
- ],
685
- "focus": "Server-specific: Apache/Nginx misconfig, .htaccess, Tomcat/AJP, IIS short names."
686
- },
687
- {
688
- "id": "bot_abuse_waf_bypass",
689
- "title": "BOT, ABUSE & WAF BYPASS",
690
- "vectors": [
691
- "Bot Protection Bypass",
692
- "Human Verification Bypass",
693
- "Captcha Bypass",
694
- "WAF Bypass",
695
- "Rate Limiting Bypass",
696
- "IP Rotation Abuse",
697
- "User-Agent Spoofing",
698
- "Header Spoofing",
699
- "Automation Abuse",
700
- "Scraping Abuse",
701
- "Fake Account Creation",
702
- "Spam Abuse",
703
- "Credential Attack Automation"
704
- ],
705
- "focus": "WAF/bot/captcha bypass: encoding, case, chunked, IP rotation, header spoofing."
706
- },
707
- {
708
- "id": "ai_llm_web_application_security",
709
- "title": "AI / LLM WEB APPLICATION SECURITY",
710
- "vectors": [
711
- "Prompt Injection",
712
- "Indirect Prompt Injection",
713
- "System Prompt Leakage",
714
- "Sensitive Information Disclosure via LLM",
715
- "LLM Output Handling Vulnerability",
716
- "Excessive Agency",
717
- "Insecure Plugin / Tool Use",
718
- "Insecure AI Agent Authorization",
719
- "Insecure Tool Calling",
720
- "Insecure Function Calling",
721
- "RAG Data Poisoning",
722
- "Vector Database Exposure",
723
- "Vector Database Misconfiguration",
724
- "Embedding Leakage",
725
- "Training Data Leakage",
726
- "Model Denial of Service",
727
- "LLM Supply Chain Risk",
728
- "AI Plugin Misconfiguration",
729
- "AI Agent Privilege Escalation",
730
- "AI Agent Workflow Bypass"
731
- ],
732
- "focus": "LLM apps: prompt injection, tool-use abuse, RAG poisoning, output handling."
733
- },
734
- {
735
- "id": "web3_wallet_integration",
736
- "title": "WEB3 / WALLET INTEGRATION",
737
- "vectors": [
738
- "Wallet Connection Abuse",
739
- "Malicious Signature Request",
740
- "Signature Replay",
741
- "Blind Signing Abuse",
742
- "Token Approval Abuse",
743
- "Unlimited Approval Abuse",
744
- "Frontend Contract Address Manipulation",
745
- "Smart Contract Frontend Mismatch",
746
- "RPC Endpoint Abuse",
747
- "Cross-Chain Bridge UI Misconfiguration",
748
- "Phishing via Wallet Prompt",
749
- "Transaction Simulation Bypass",
750
- "WalletConnect Misconfiguration",
751
- "Wrong Chain ID Handling",
752
- "Token Metadata Spoofing",
753
- "Airdrop Claim Abuse",
754
- "NFT Approval Abuse",
755
- "Web3 Authentication Bypass",
756
- "SIWE / Sign-In with Ethereum Misconfiguration",
757
- "Replayable Login Signature"
758
- ],
759
- "focus": "Web3: wallet signature phishing, contract interaction, RPC manipulation."
760
- },
761
- {
762
- "id": "privacy_tracking_exposure",
763
- "title": "PRIVACY & TRACKING EXPOSURE",
764
- "vectors": [
765
- "Consent Bypass",
766
- "Cookie Consent Misconfiguration",
767
- "Tracking Pixel Data Leakage",
768
- "Analytics Token Exposure",
769
- "PII Leakage to Third-Party Scripts",
770
- "Session Replay Tool Exposure",
771
- "Misconfigured Tag Manager",
772
- "Leaky Referrer Header",
773
- "Personal Data in URL",
774
- "Personal Data in Logs",
775
- "Personal Data in Analytics Events",
776
- "Third-Party Script Data Leakage",
777
- "Cross-Site Tracking Misconfiguration",
778
- "Insecure Consent Storage",
779
- "Privacy Preference Bypass"
780
- ],
781
- "focus": "PII leakage, tracking, broken data deletion (right to be forgotten)."
782
- },
783
- {
784
- "id": "xs_leaks_browser_isolation",
785
- "title": "XS-LEAKS & BROWSER ISOLATION",
786
- "vectors": [
787
- "XS-Leaks / Cross-Site Leaks",
788
- "Cross-Origin Resource Policy Misconfiguration",
789
- "Cross-Origin Embedder Policy Misconfiguration",
790
- "Cross-Origin Opener Policy Misconfiguration",
791
- "CORS Side-Channel",
792
- "Browser Timing Attack",
793
- "Browser Cache Side-Channel",
794
- "Window Name Leakage",
795
- "History Sniffing",
796
- "Frame Counting Attack",
797
- "Error Event Leak",
798
- "Resource Load Timing Leak",
799
- "Cross-Origin Redirect Leak",
800
- "Cross-Origin Search Leak",
801
- "Cross-Origin State Inference",
802
- "SameSite Cookie Misconfiguration",
803
- "Site Isolation Bypass"
804
- ],
805
- "focus": "XS-Leaks: cross-site leaks, browser isolation bypass, side-channel."
806
- },
807
- {
808
- "id": "miscellaneous",
809
- "title": "MISCELLANEOUS",
810
- "vectors": [
811
- "Improper Input Validation",
812
- "Improper Output Encoding",
813
- "Improper Error Handling",
814
- "Improper Asset Management",
815
- "Improper Logging",
816
- "Insufficient Monitoring",
817
- "Unsafe File Processing",
818
- "Unsafe URL Fetching",
819
- "Unsafe Parser Usage",
820
- "Unsafe Redirect Handling",
821
- "Insecure Default Setting",
822
- "Business Logic Flaw",
823
- "Security Misconfiguration",
824
- "Human Verification Bypass",
825
- "Bot Protection Bypass",
826
- "WAF Bypass",
827
- "Rate Limiting Bypass"
828
- ],
829
- "focus": "Anything not covered: backup files, test endpoints, leftover debug."
830
- }
831
- ]
2
+ "_comment": "Web attack vector taxonomy \u2014 master reference for attack-surface mapping (BLITZ tier). 34 categories of generic security terminology (OWASP/CWE-style attack vector names).",
3
+ "version": 1,
4
+ "categories": [
5
+ {
6
+ "id": "remote_code_execution",
7
+ "title": "REMOTE CODE EXECUTION",
8
+ "vectors": [
9
+ "RCE / Remote Code Execution",
10
+ "Command Injection",
11
+ "OS Command Injection",
12
+ "Code Injection",
13
+ "Server-Side Template Injection / SSTI",
14
+ "Unsafe Eval / Dynamic Code Execution",
15
+ "File Upload to RCE",
16
+ "Arbitrary File Write to RCE",
17
+ "Log Poisoning to RCE",
18
+ "PHAR Deserialization",
19
+ "PHP Object Injection",
20
+ "Java Deserialization RCE",
21
+ "ImageMagick RCE",
22
+ "GhostScript RCE",
23
+ "Dependency-Based RCE",
24
+ "Plugin / Module RCE"
25
+ ],
26
+ "focus": "Any sink that executes attacker-influenced code: eval/system, unserialize, template engines, deserialization. Test for direct exec; escalate via file write -> include -> exec."
27
+ },
28
+ {
29
+ "id": "sql_database_attacks",
30
+ "title": "SQL & DATABASE ATTACKS",
31
+ "vectors": [
32
+ "SQL Injection",
33
+ "Blind SQL Injection",
34
+ "Time-Based SQL Injection",
35
+ "Boolean-Based SQL Injection",
36
+ "Error-Based SQL Injection",
37
+ "Union-Based SQL Injection",
38
+ "Stacked Query Injection",
39
+ "Second-Order SQL Injection",
40
+ "NoSQL Injection",
41
+ "MongoDB Injection",
42
+ "ORM Injection",
43
+ "GraphQL Database Injection",
44
+ "Database Error Disclosure",
45
+ "Exposed Database Service",
46
+ "Database Misconfiguration"
47
+ ],
48
+ "focus": "SQL/NoSQL injection into queries. Test UNION, boolean, time-based, error-based; escalate via FILE privilege (INTO OUTFILE) or ORM bypass."
49
+ },
50
+ {
51
+ "id": "authentication_session",
52
+ "title": "AUTHENTICATION & SESSION",
53
+ "vectors": [
54
+ "Authentication Bypass",
55
+ "Authorization Bypass",
56
+ "Account Takeover / ATO",
57
+ "Privilege Escalation",
58
+ "Vertical Privilege Escalation",
59
+ "Horizontal Privilege Escalation",
60
+ "Session Hijacking",
61
+ "Session Fixation",
62
+ "Session Poisoning",
63
+ "Cookie Injection",
64
+ "Cookie Tossing",
65
+ "JWT None Algorithm Attack",
66
+ "JWT Key Confusion",
67
+ "JWT Weak Secret",
68
+ "JWT Expiration Missing",
69
+ "JWT Replay Attack",
70
+ "OAuth Misconfiguration",
71
+ "SSO Misconfiguration",
72
+ "SAML Misconfiguration",
73
+ "OpenID Connect Misconfiguration",
74
+ "MFA Bypass",
75
+ "OTP Bypass",
76
+ "Password Reset Poisoning",
77
+ "Password Reset Token Leakage",
78
+ "Password Reset Bypass",
79
+ "Email Verification Bypass",
80
+ "Weak Password Policy",
81
+ "Credential Stuffing",
82
+ "Brute Force Attack",
83
+ "Password Spraying",
84
+ "Account Enumeration",
85
+ "Default Credentials",
86
+ "Hardcoded Credentials",
87
+ "Insecure Remember-Me Token",
88
+ "Weak / Predictable Token",
89
+ "Session Timeout Missing",
90
+ "Concurrent Session Abuse"
91
+ ],
92
+ "focus": "Auth bypass, session fixation/hijacking, JWT misconfig (none alg, weak secret), cookie tampering, privilege escalation."
93
+ },
94
+ {
95
+ "id": "access_control",
96
+ "title": "ACCESS CONTROL",
97
+ "vectors": [
98
+ "Broken Access Control",
99
+ "Missing Access Control",
100
+ "IDOR / Insecure Direct Object Reference",
101
+ "BOLA / Broken Object Level Authorization",
102
+ "BFLA / Broken Function Level Authorization",
103
+ "Broken Object Property Level Authorization",
104
+ "Function-Level Access Control Bypass",
105
+ "Object-Level Access Control Bypass",
106
+ "Forced Browsing",
107
+ "Insecure Direct Function Access",
108
+ "Role Bypass",
109
+ "Tenant Isolation Bypass",
110
+ "Multi-Tenant Data Leakage",
111
+ "Admin Panel Access Bypass",
112
+ "Mass Assignment",
113
+ "Quota Bypass",
114
+ "Rate Limit Bypass",
115
+ "CORS Misconfiguration"
116
+ ],
117
+ "focus": "IDOR, broken object-level auth, missing function-level access, path-based ACL bypass."
118
+ },
119
+ {
120
+ "id": "file_path_attacks",
121
+ "title": "FILE & PATH ATTACKS",
122
+ "vectors": [
123
+ "Path Traversal",
124
+ "Directory Traversal",
125
+ "LFI / Local File Inclusion",
126
+ "RFI / Remote File Inclusion",
127
+ "Arbitrary File Read",
128
+ "Arbitrary File Download",
129
+ "Arbitrary File Upload",
130
+ "Unrestricted File Upload",
131
+ "File Type Bypass",
132
+ "MIME Type Bypass",
133
+ "Double Extension Upload",
134
+ "Zip Slip / Archive Traversal",
135
+ "Archive Extraction Abuse",
136
+ "Backup File Exposure",
137
+ "Environment File Exposure",
138
+ ".env Exposure",
139
+ "Config File Exposure",
140
+ "Repository Exposure",
141
+ ".git Exposure",
142
+ ".svn Exposure",
143
+ "Directory Listing",
144
+ "Temporary File Exposure",
145
+ "Log File Exposure",
146
+ "Sensitive File Disclosure"
147
+ ],
148
+ "focus": "Path traversal, LFI/RFI, arbitrary file read/write, upload path control."
149
+ },
150
+ {
151
+ "id": "injection_attacks",
152
+ "title": "INJECTION ATTACKS",
153
+ "vectors": [
154
+ "Insecure Deserialization",
155
+ "Prototype Pollution",
156
+ "XXE / XML External Entity Injection",
157
+ "XPath Injection",
158
+ "LDAP Injection",
159
+ "CRLF Injection",
160
+ "HTTP Response Splitting",
161
+ "HTTP Parameter Pollution",
162
+ "HTTP Request Smuggling",
163
+ "Host Header Injection",
164
+ "Header Injection",
165
+ "Email Injection",
166
+ "Email Header Injection",
167
+ "HTML Injection",
168
+ "CSV Injection",
169
+ "Formula Injection",
170
+ "Command Argument Injection",
171
+ "Expression Language Injection",
172
+ "OGNL Injection",
173
+ "SpEL Injection",
174
+ "Jinja2 Injection",
175
+ "Freemarker Injection",
176
+ "Velocity Injection"
177
+ ],
178
+ "focus": "Beyond SQL: LDAP, XPath, XML/XXE, CRLF, HTTP header injection, template injection."
179
+ },
180
+ {
181
+ "id": "xss_client_side_attacks",
182
+ "title": "XSS & CLIENT-SIDE ATTACKS",
183
+ "vectors": [
184
+ "Reflected XSS",
185
+ "Stored XSS",
186
+ "DOM-Based XSS",
187
+ "Blind XSS",
188
+ "Mutation XSS / mXSS",
189
+ "Universal XSS",
190
+ "Client-Side Template Injection",
191
+ "DOM Clobbering",
192
+ "postMessage Misconfiguration",
193
+ "postMessage Origin Bypass",
194
+ "CSP Misconfiguration",
195
+ "CSP Bypass",
196
+ "JSONP Abuse",
197
+ "Script Gadget Abuse",
198
+ "Source Map Exposure",
199
+ "Sensitive Data in JavaScript",
200
+ "Sensitive Data in LocalStorage",
201
+ "Sensitive Data in SessionStorage",
202
+ "Service Worker Abuse",
203
+ "Web Worker Abuse",
204
+ "Clickjacking",
205
+ "UI Redressing"
206
+ ],
207
+ "focus": "Reflected/stored/DOM XSS, prototype pollution, client-side template injection, postMessage issues."
208
+ },
209
+ {
210
+ "id": "csrf_redirect",
211
+ "title": "CSRF & REDIRECT",
212
+ "vectors": [
213
+ "CSRF / Cross-Site Request Forgery",
214
+ "Login CSRF",
215
+ "Logout CSRF",
216
+ "Stored CSRF",
217
+ "Open Redirect",
218
+ "Unvalidated Redirect",
219
+ "OAuth Redirect URI Bypass",
220
+ "SSO Redirect Abuse",
221
+ "Clickjacking",
222
+ "UI Redressing"
223
+ ],
224
+ "focus": "CSRF, open redirect, clickjacking, CORS misconfiguration."
225
+ },
226
+ {
227
+ "id": "ssrf",
228
+ "title": "SSRF",
229
+ "vectors": [
230
+ "SSRF / Server-Side Request Forgery",
231
+ "Blind SSRF",
232
+ "Semi-Blind SSRF",
233
+ "Full-Read SSRF",
234
+ "SSRF to Internal Network",
235
+ "SSRF to Cloud Metadata",
236
+ "SSRF to Localhost",
237
+ "SSRF to Redis",
238
+ "SSRF to Memcached",
239
+ "SSRF via PDF Generator",
240
+ "SSRF via Image Fetcher",
241
+ "SSRF via Webhook",
242
+ "SSRF via URL Preview",
243
+ "DNS Rebinding",
244
+ "Gopher-Based SSRF",
245
+ "Cloud Metadata Exposure"
246
+ ],
247
+ "focus": "Server-side request forgery: internal port scan, cloud metadata, file read via URL schemes."
248
+ },
249
+ {
250
+ "id": "api_security",
251
+ "title": "API SECURITY",
252
+ "vectors": [
253
+ "BOLA / Broken Object Level Authorization",
254
+ "BFLA / Broken Function Level Authorization",
255
+ "Broken Object Property Level Authorization",
256
+ "Excessive Data Exposure",
257
+ "Mass Assignment",
258
+ "Unrestricted Resource Consumption",
259
+ "Unrestricted Access to Sensitive Business Flows",
260
+ "Improper API Inventory Management",
261
+ "Unsafe Consumption of APIs",
262
+ "API Versioning Misconfiguration",
263
+ "Deprecated API Exposure",
264
+ "Shadow API Exposure",
265
+ "Exposed Swagger / OpenAPI Docs",
266
+ "Exposed GraphQL Endpoint",
267
+ "GraphQL Introspection Exposure",
268
+ "GraphQL Query Depth Abuse",
269
+ "GraphQL Query Complexity Abuse",
270
+ "GraphQL Batching Abuse",
271
+ "GraphQL Alias Abuse",
272
+ "GraphQL Field Suggestion Leakage",
273
+ "REST API Misconfiguration",
274
+ "WebSocket Misconfiguration",
275
+ "WebSocket Authentication Bypass",
276
+ "WebSocket Authorization Bypass"
277
+ ],
278
+ "focus": "REST/GraphQL: auth gaps, mass assignment, BOLA, rate limit, over-fetching."
279
+ },
280
+ {
281
+ "id": "business_logic",
282
+ "title": "BUSINESS LOGIC",
283
+ "vectors": [
284
+ "Business Logic Flaw",
285
+ "Workflow Bypass",
286
+ "Payment Bypass",
287
+ "Price Manipulation",
288
+ "Coupon Abuse",
289
+ "Voucher Abuse",
290
+ "Referral Abuse",
291
+ "Reward Abuse",
292
+ "Negative Quantity Abuse",
293
+ "Race Condition in Checkout",
294
+ "Inventory Manipulation",
295
+ "Order Manipulation",
296
+ "Cart Manipulation",
297
+ "Discount Stacking Abuse",
298
+ "Limit Bypass",
299
+ "Quota Bypass",
300
+ "Subscription Bypass",
301
+ "Trial Abuse",
302
+ "Refund Abuse",
303
+ "Feature Access Bypass",
304
+ "State Machine Bypass",
305
+ "Improper Validation of Business Rules"
306
+ ],
307
+ "focus": "Logic flaws: price tampering, step skipping, race conditions on money/state transitions."
308
+ },
309
+ {
310
+ "id": "race_condition",
311
+ "title": "RACE CONDITION",
312
+ "vectors": [
313
+ "Race Condition",
314
+ "TOCTOU / Time-of-Check to Time-of-Use",
315
+ "Double Spending",
316
+ "Concurrent Request Abuse",
317
+ "Parallel Checkout Abuse",
318
+ "Parallel Coupon Abuse",
319
+ "Parallel Password Reset Abuse",
320
+ "Parallel OTP Verification Abuse",
321
+ "Account Balance Race",
322
+ "Inventory Race",
323
+ "File Operation Race"
324
+ ],
325
+ "focus": "TOCTOU, parallel request abuse, rate-limit race, session race."
326
+ },
327
+ {
328
+ "id": "cache_cdn",
329
+ "title": "CACHE & CDN",
330
+ "vectors": [
331
+ "Web Cache Poisoning",
332
+ "Web Cache Deception",
333
+ "Cache Key Confusion",
334
+ "Cache Header Injection",
335
+ "CDN Misconfiguration",
336
+ "Origin Header Bypass",
337
+ "Stale Cache Exposure",
338
+ "Sensitive Data Cached",
339
+ "Unauthenticated Cache Access",
340
+ "Cache-Based Information Disclosure"
341
+ ],
342
+ "focus": "Cache poisoning/deception, CDN bypass to origin, host header poisoning."
343
+ },
344
+ {
345
+ "id": "domain_dns",
346
+ "title": "DOMAIN & DNS",
347
+ "vectors": [
348
+ "Subdomain Takeover",
349
+ "Dangling DNS Record",
350
+ "Dangling CNAME",
351
+ "Dangling A Record",
352
+ "Dangling NS Record",
353
+ "Zone Transfer",
354
+ "DNS Misconfiguration",
355
+ "Wildcard DNS Abuse",
356
+ "Domain Fronting Misconfiguration",
357
+ "Expired Domain Takeover",
358
+ "Email Domain Misconfiguration",
359
+ "SPF Misconfiguration",
360
+ "DKIM Misconfiguration",
361
+ "DMARC Misconfiguration",
362
+ "Broken Link Hijacking / Expired Domain Takeover (outbound link to an expired, registrable domain)",
363
+ "DNS Rebinding (hostname re-resolves to internal IP \u2014 SSRF/same-origin bypass)"
364
+ ],
365
+ "focus": "Subdomain takeover, dangling DNS, DNS rebinding, zone transfer."
366
+ },
367
+ {
368
+ "id": "cloud_infrastructure_exposure",
369
+ "title": "CLOUD & INFRASTRUCTURE EXPOSURE",
370
+ "vectors": [
371
+ "Exposed S3 Bucket",
372
+ "Exposed Cloud Storage Bucket",
373
+ "Public Blob Storage",
374
+ "Cloud Metadata Exposure",
375
+ "Exposed Kubernetes Dashboard",
376
+ "Exposed Docker API",
377
+ "Exposed Redis",
378
+ "Exposed Memcached",
379
+ "Exposed Elasticsearch",
380
+ "Exposed MongoDB",
381
+ "Exposed PostgreSQL",
382
+ "Exposed MySQL",
383
+ "Exposed Prometheus",
384
+ "Exposed Grafana",
385
+ "Exposed Kibana",
386
+ "Exposed Jenkins",
387
+ "Exposed GitLab",
388
+ "Exposed Admin Panel",
389
+ "Exposed Metrics Endpoint",
390
+ "Exposed Debug Endpoint",
391
+ "Exposed Actuator Endpoint",
392
+ "Misconfigured Reverse Proxy",
393
+ "Internal Service Exposure",
394
+ "Open Management Port"
395
+ ],
396
+ "focus": "Exposed storage buckets, IAM misconfiguration, metadata service abuse, serverless misconfig."
397
+ },
398
+ {
399
+ "id": "configuration_security_headers",
400
+ "title": "CONFIGURATION & SECURITY HEADERS",
401
+ "vectors": [
402
+ "Security Misconfiguration",
403
+ "Debug Mode Enabled",
404
+ "Verbose Error Message",
405
+ "Stack Trace Disclosure",
406
+ "Default Installation Page",
407
+ "Default Admin Panel",
408
+ "Default Credentials",
409
+ "Insecure HTTP Methods",
410
+ "PUT Method Enabled",
411
+ "TRACE Method Enabled",
412
+ "CORS Misconfiguration",
413
+ "Missing Security Headers",
414
+ "Weak Security Headers",
415
+ "HSTS Missing",
416
+ "CSP Missing",
417
+ "X-Frame-Options Missing",
418
+ "X-Content-Type-Options Missing",
419
+ "Referrer-Policy Missing",
420
+ "Insecure TLS Configuration",
421
+ "Weak Cipher Suites",
422
+ "Expired SSL Certificate",
423
+ "Mixed Content",
424
+ "Directory Listing Enabled"
425
+ ],
426
+ "focus": "Missing/misconfigured security headers, debug endpoints, default credentials."
427
+ },
428
+ {
429
+ "id": "cryptography_token",
430
+ "title": "CRYPTOGRAPHY & TOKEN",
431
+ "vectors": [
432
+ "Weak Cryptography",
433
+ "Broken Encryption",
434
+ "Insecure Randomness",
435
+ "Predictable Token",
436
+ "Weak Token Generation",
437
+ "Token Replay",
438
+ "Token Leakage",
439
+ "Token in URL",
440
+ "JWT Weak Secret",
441
+ "JWT Missing Expiration",
442
+ "JWT Algorithm Confusion",
443
+ "Hardcoded API Key",
444
+ "Hardcoded Secret",
445
+ "Secret Leakage in Frontend",
446
+ "Secret Leakage in Repository",
447
+ "Weak Password Hashing",
448
+ "Plaintext Password Storage",
449
+ "Insecure Key Management",
450
+ "Sensitive Data Exposure via Logs",
451
+ "Padding Oracle (CBC PKCS#7 \u2014 decrypt encrypted cookies/tokens via error/timing oracle)"
452
+ ],
453
+ "focus": "Weak/guessable tokens, predictable reset, JWT/encryption key reuse, padding oracle."
454
+ },
455
+ {
456
+ "id": "supply_chain",
457
+ "title": "SUPPLY CHAIN",
458
+ "vectors": [
459
+ "Supply Chain Attack",
460
+ "Dependency Confusion",
461
+ "Dependency Hijacking",
462
+ "Typosquatting Package",
463
+ "Malicious Package Injection",
464
+ "Compromised Package",
465
+ "Outdated Dependency",
466
+ "Vulnerable Dependency",
467
+ "Composer Package Abuse",
468
+ "NPM Package Abuse",
469
+ "PyPI Package Abuse",
470
+ "Maven Package Abuse",
471
+ "Plugin Supply Chain Attack",
472
+ "Theme Supply Chain Attack",
473
+ "Third-Party Script Compromise",
474
+ "CDN Script Compromise",
475
+ "Subresource Integrity Missing"
476
+ ],
477
+ "focus": "Dependency confusion, malicious package, build pipeline injection."
478
+ },
479
+ {
480
+ "id": "ci_cd_devops",
481
+ "title": "CI/CD & DEVOPS",
482
+ "vectors": [
483
+ "CI/CD Secret Exposure",
484
+ "Exposed GitHub Actions Secrets",
485
+ "Exposed GitLab CI Variables",
486
+ "Exposed Jenkins Credentials",
487
+ "Build Artifact Exposure",
488
+ "Public CI Logs",
489
+ "Docker Image Secret Leakage",
490
+ "Hardcoded Secrets in Container Image",
491
+ "Insecure Deployment Pipeline",
492
+ "Over-Permissioned CI Token",
493
+ "Leaked SSH Key",
494
+ "Leaked Cloud Key",
495
+ "Leaked API Token",
496
+ "Public Backup Artifact"
497
+ ],
498
+ "focus": "CI/CD secrets in pipeline, exposed build servers, Docker misconfiguration."
499
+ },
500
+ {
501
+ "id": "information_disclosure",
502
+ "title": "INFORMATION DISCLOSURE",
503
+ "vectors": [
504
+ "Information Disclosure",
505
+ "Data Leakage",
506
+ "Sensitive Data Exposure",
507
+ "PII Exposure",
508
+ "User Data Exposure",
509
+ "Admin Data Exposure",
510
+ "Source Code Disclosure",
511
+ "Stack Trace Disclosure",
512
+ "Error Message Disclosure",
513
+ "Server Banner Disclosure",
514
+ "Version Disclosure",
515
+ "Internal IP Disclosure",
516
+ "Internal Path Disclosure",
517
+ "Debug Information Disclosure",
518
+ "API Key Disclosure",
519
+ "Access Token Disclosure",
520
+ "Private Key Disclosure",
521
+ "Backup Disclosure",
522
+ "Log Disclosure",
523
+ "Database Dump Exposure",
524
+ "Source Map Disclosure"
525
+ ],
526
+ "focus": "Verbose errors, source/backup exposure, .git/.env leaks, debug info."
527
+ },
528
+ {
529
+ "id": "dos_resource_abuse",
530
+ "title": "DoS & RESOURCE ABUSE",
531
+ "vectors": [
532
+ "DoS / Denial of Service",
533
+ "Application-Level DoS",
534
+ "Resource Exhaustion",
535
+ "CPU Exhaustion",
536
+ "Memory Exhaustion",
537
+ "Disk Exhaustion",
538
+ "Large Payload DoS",
539
+ "File Upload DoS",
540
+ "Slowloris",
541
+ "ReDoS / Regular Expression DoS",
542
+ "XML Bomb",
543
+ "Billion Laughs Attack",
544
+ "Zip Bomb",
545
+ "Decompression Bomb",
546
+ "GraphQL Complexity DoS",
547
+ "GraphQL Depth DoS",
548
+ "Expensive Search Query DoS",
549
+ "Pagination Abuse",
550
+ "Connection Exhaustion",
551
+ "Webhook Flooding"
552
+ ],
553
+ "focus": "Resource exhaustion, ReDoS, zip bomb, unbounded loops, expensive queries."
554
+ },
555
+ {
556
+ "id": "mobile_hybrid_web",
557
+ "title": "MOBILE & HYBRID WEB",
558
+ "vectors": [
559
+ "Deep Link Hijacking",
560
+ "Universal Link Misconfiguration",
561
+ "App Link Misconfiguration",
562
+ "WebView JavaScript Bridge Abuse",
563
+ "Insecure WebView Configuration",
564
+ "Insecure App-to-Web Token Sharing",
565
+ "Mobile OAuth Redirect Abuse",
566
+ "Custom Scheme Hijacking",
567
+ "Local File Access via WebView",
568
+ "Insecure Deeplink Parameter Handling"
569
+ ],
570
+ "focus": "Mobile API exposure, insecure deep links, WebView JS bridge, hardcoded keys."
571
+ },
572
+ {
573
+ "id": "third_party_integration",
574
+ "title": "THIRD-PARTY INTEGRATION",
575
+ "vectors": [
576
+ "Webhook Misconfiguration",
577
+ "Webhook SSRF",
578
+ "Webhook Signature Bypass",
579
+ "Payment Gateway Misconfiguration",
580
+ "OAuth App Misconfiguration",
581
+ "Third-Party API Key Leakage",
582
+ "Third-Party Widget XSS",
583
+ "Analytics Script Exposure",
584
+ "Chat Widget Misconfiguration",
585
+ "Email Service Misconfiguration",
586
+ "Storage Integration Misconfiguration"
587
+ ],
588
+ "focus": "OAuth/SSO misconfiguration, webhook SSRF, payment/plugin callback abuse."
589
+ },
590
+ {
591
+ "id": "email_account_communication",
592
+ "title": "EMAIL & ACCOUNT COMMUNICATION",
593
+ "vectors": [
594
+ "Email Header Injection",
595
+ "SMTP Misconfiguration",
596
+ "Email Spoofing",
597
+ "SPF Misconfiguration",
598
+ "DKIM Misconfiguration",
599
+ "DMARC Misconfiguration",
600
+ "Password Reset Email Poisoning",
601
+ "Verification Link Leakage",
602
+ "Magic Link Leakage",
603
+ "Account Enumeration via Email",
604
+ "HTML Email Injection"
605
+ ],
606
+ "focus": "Email header injection, password reset via email, account recovery flaws."
607
+ },
608
+ {
609
+ "id": "admin_management_panel",
610
+ "title": "ADMIN & MANAGEMENT PANEL",
611
+ "vectors": [
612
+ "Exposed Admin Panel",
613
+ "Default Admin Credentials",
614
+ "Weak Admin Authentication",
615
+ "Admin Path Disclosure",
616
+ "Admin Function Access Bypass",
617
+ "Unauthenticated Admin API",
618
+ "Debug Console Exposure",
619
+ "Developer Console Exposure",
620
+ "Management Interface Exposure",
621
+ "Internal Dashboard Exposure"
622
+ ],
623
+ "focus": "Exposed admin panels, default admin credentials, broken admin auth."
624
+ },
625
+ {
626
+ "id": "modern_web_frameworks",
627
+ "title": "MODERN WEB FRAMEWORKS",
628
+ "vectors": [
629
+ "Next.js Source Map Exposure",
630
+ "Next.js Image Optimization SSRF",
631
+ "Next.js Middleware Misconfiguration",
632
+ "React Hydration Data Leakage",
633
+ "Angular Template Injection",
634
+ "Vue Template Injection",
635
+ "Nuxt Misconfiguration",
636
+ "Webpack Source Map Exposure",
637
+ "Vite Dev Server Exposure",
638
+ "Exposed Build Manifest",
639
+ "Client-Side Route Access Bypass",
640
+ "Frontend Feature Flag Abuse"
641
+ ],
642
+ "focus": "Framework-specific: Laravel debug/Ignition, Spring actuator, Django debug, Rails mass assignment."
643
+ },
644
+ {
645
+ "id": "cms_plugin_theme",
646
+ "title": "CMS, PLUGIN & THEME",
647
+ "vectors": [
648
+ "WordPress Plugin Vulnerability",
649
+ "WordPress Theme Vulnerability",
650
+ "Joomla Extension Vulnerability",
651
+ "Drupal Module Vulnerability",
652
+ "OJS Plugin Vulnerability",
653
+ "OpenSID Module Vulnerability",
654
+ "CMS Arbitrary File Upload",
655
+ "CMS Authentication Bypass",
656
+ "CMS SQL Injection",
657
+ "CMS Stored XSS",
658
+ "CMS RCE",
659
+ "CMS Misconfiguration",
660
+ "Outdated CMS Core",
661
+ "Outdated Plugin",
662
+ "Outdated Theme"
663
+ ],
664
+ "focus": "CMS vulnerabilities: WP plugins/themes, known CVEs, plugin upload, serialized options."
665
+ },
666
+ {
667
+ "id": "server_platform_specific",
668
+ "title": "SERVER & PLATFORM SPECIFIC",
669
+ "vectors": [
670
+ "PHP Object Injection",
671
+ "PHP File Inclusion",
672
+ "PHP Upload Bypass",
673
+ "PHP Session Poisoning",
674
+ "Laravel Debug Exposure",
675
+ "Laravel Ignition RCE",
676
+ "Laravel APP_KEY Exposure",
677
+ "Symfony Profiler Exposure",
678
+ "Spring Boot Actuator Exposure",
679
+ "Spring Expression Injection",
680
+ "Node.js Prototype Pollution",
681
+ "Node.js Deserialization",
682
+ "Express Misconfiguration",
683
+ "Django Debug Exposure",
684
+ "Flask Debug Console Exposure",
685
+ "Ruby on Rails Secret Key Exposure",
686
+ "ASP.NET ViewState Misconfiguration"
687
+ ],
688
+ "focus": "Server-specific: Apache/Nginx misconfig, .htaccess, Tomcat/AJP, IIS short names."
689
+ },
690
+ {
691
+ "id": "bot_abuse_waf_bypass",
692
+ "title": "BOT, ABUSE & WAF BYPASS",
693
+ "vectors": [
694
+ "Bot Protection Bypass",
695
+ "Human Verification Bypass",
696
+ "Captcha Bypass",
697
+ "WAF Bypass",
698
+ "Rate Limiting Bypass",
699
+ "IP Rotation Abuse",
700
+ "User-Agent Spoofing",
701
+ "Header Spoofing",
702
+ "Automation Abuse",
703
+ "Scraping Abuse",
704
+ "Fake Account Creation",
705
+ "Spam Abuse",
706
+ "Credential Attack Automation"
707
+ ],
708
+ "focus": "WAF/bot/captcha bypass: encoding, case, chunked, IP rotation, header spoofing."
709
+ },
710
+ {
711
+ "id": "ai_llm_web_application_security",
712
+ "title": "AI / LLM WEB APPLICATION SECURITY",
713
+ "vectors": [
714
+ "Prompt Injection",
715
+ "Indirect Prompt Injection",
716
+ "System Prompt Leakage",
717
+ "Sensitive Information Disclosure via LLM",
718
+ "LLM Output Handling Vulnerability",
719
+ "Excessive Agency",
720
+ "Insecure Plugin / Tool Use",
721
+ "Insecure AI Agent Authorization",
722
+ "Insecure Tool Calling",
723
+ "Insecure Function Calling",
724
+ "RAG Data Poisoning",
725
+ "Vector Database Exposure",
726
+ "Vector Database Misconfiguration",
727
+ "Embedding Leakage",
728
+ "Training Data Leakage",
729
+ "Model Denial of Service",
730
+ "LLM Supply Chain Risk",
731
+ "AI Plugin Misconfiguration",
732
+ "AI Agent Privilege Escalation",
733
+ "AI Agent Workflow Bypass"
734
+ ],
735
+ "focus": "LLM apps: prompt injection, tool-use abuse, RAG poisoning, output handling."
736
+ },
737
+ {
738
+ "id": "web3_wallet_integration",
739
+ "title": "WEB3 / WALLET INTEGRATION",
740
+ "vectors": [
741
+ "Wallet Connection Abuse",
742
+ "Malicious Signature Request",
743
+ "Signature Replay",
744
+ "Blind Signing Abuse",
745
+ "Token Approval Abuse",
746
+ "Unlimited Approval Abuse",
747
+ "Frontend Contract Address Manipulation",
748
+ "Smart Contract Frontend Mismatch",
749
+ "RPC Endpoint Abuse",
750
+ "Cross-Chain Bridge UI Misconfiguration",
751
+ "Phishing via Wallet Prompt",
752
+ "Transaction Simulation Bypass",
753
+ "WalletConnect Misconfiguration",
754
+ "Wrong Chain ID Handling",
755
+ "Token Metadata Spoofing",
756
+ "Airdrop Claim Abuse",
757
+ "NFT Approval Abuse",
758
+ "Web3 Authentication Bypass",
759
+ "SIWE / Sign-In with Ethereum Misconfiguration",
760
+ "Replayable Login Signature"
761
+ ],
762
+ "focus": "Web3: wallet signature phishing, contract interaction, RPC manipulation."
763
+ },
764
+ {
765
+ "id": "privacy_tracking_exposure",
766
+ "title": "PRIVACY & TRACKING EXPOSURE",
767
+ "vectors": [
768
+ "Consent Bypass",
769
+ "Cookie Consent Misconfiguration",
770
+ "Tracking Pixel Data Leakage",
771
+ "Analytics Token Exposure",
772
+ "PII Leakage to Third-Party Scripts",
773
+ "Session Replay Tool Exposure",
774
+ "Misconfigured Tag Manager",
775
+ "Leaky Referrer Header",
776
+ "Personal Data in URL",
777
+ "Personal Data in Logs",
778
+ "Personal Data in Analytics Events",
779
+ "Third-Party Script Data Leakage",
780
+ "Cross-Site Tracking Misconfiguration",
781
+ "Insecure Consent Storage",
782
+ "Privacy Preference Bypass"
783
+ ],
784
+ "focus": "PII leakage, tracking, broken data deletion (right to be forgotten)."
785
+ },
786
+ {
787
+ "id": "xs_leaks_browser_isolation",
788
+ "title": "XS-LEAKS & BROWSER ISOLATION",
789
+ "vectors": [
790
+ "XS-Leaks / Cross-Site Leaks",
791
+ "Cross-Origin Resource Policy Misconfiguration",
792
+ "Cross-Origin Embedder Policy Misconfiguration",
793
+ "Cross-Origin Opener Policy Misconfiguration",
794
+ "CORS Side-Channel",
795
+ "Browser Timing Attack",
796
+ "Browser Cache Side-Channel",
797
+ "Window Name Leakage",
798
+ "History Sniffing",
799
+ "Frame Counting Attack",
800
+ "Error Event Leak",
801
+ "Resource Load Timing Leak",
802
+ "Cross-Origin Redirect Leak",
803
+ "Cross-Origin Search Leak",
804
+ "Cross-Origin State Inference",
805
+ "SameSite Cookie Misconfiguration",
806
+ "Site Isolation Bypass"
807
+ ],
808
+ "focus": "XS-Leaks: cross-site leaks, browser isolation bypass, side-channel."
809
+ },
810
+ {
811
+ "id": "miscellaneous",
812
+ "title": "MISCELLANEOUS",
813
+ "vectors": [
814
+ "Improper Input Validation",
815
+ "Improper Output Encoding",
816
+ "Improper Error Handling",
817
+ "Improper Asset Management",
818
+ "Improper Logging",
819
+ "Insufficient Monitoring",
820
+ "Unsafe File Processing",
821
+ "Unsafe URL Fetching",
822
+ "Unsafe Parser Usage",
823
+ "Unsafe Redirect Handling",
824
+ "Insecure Default Setting",
825
+ "Business Logic Flaw",
826
+ "Security Misconfiguration",
827
+ "Human Verification Bypass",
828
+ "Bot Protection Bypass",
829
+ "WAF Bypass",
830
+ "Rate Limiting Bypass"
831
+ ],
832
+ "focus": "Anything not covered: backup files, test endpoints, leftover debug."
833
+ }
834
+ ]
832
835
  }