Learning Center
Our mission is to provide the most comprehensive and up-to-date security knowledge for developers, testers, and security professionals.
A
- Attack surfaceAn attack surface is every point where an attacker can try to get into a system, affect it, or pull data out of it: internet-facing hosts, APIs, login pages, cloud services, internal network services, physical access and the people who can be tricked.
- Authenticated penetration testingAuthenticated penetration testing is a pentest in which the tester logs in with real accounts, usually one per role and tenant, and attacks the application from inside the session, looking for users who can read or change data, or run functions, that their role should not allow.
B
- Black-box, gray-box and white-box penetration testingBlack-box, gray-box and white-box testing describe how much a penetration tester is told before starting: nothing beyond a target (black-box), partial information such as accounts and API specs (gray-box), or full access to source code, architecture and configuration (white-box).
- Broken function level authorization (BFLA)Broken function level authorization (BFLA) is an API vulnerability where an endpoint meant for a higher role, such as an admin or support action, does not check the caller's role, so an ordinary user calls it directly and performs privileged operations like managing users or changing settings.
- Broken object level authorization (BOLA)Broken object level authorization (BOLA) is an API vulnerability where an endpoint accepts an object ID from the client and returns or changes that object without checking the caller owns it, so an attacker swaps in another user's or tenant's ID and reads, edits or deletes their records.
- Business logic vulnerabilityA business logic vulnerability is a flaw in how an application enforces its own rules, letting an attacker abuse legitimate features in unintended sequences or with unexpected values to skip payment, pay negative amounts, or reach states the workflow was meant to prevent.
C
- CI/CD pipeline securityCI/CD pipeline security is the practice of controlling who and what can change, trigger and run your build and deployment pipelines, and what those pipelines can reach, so an attacker who gets into a branch, a third-party action or a runner cannot use the pipeline's secrets and deploy rights to ship code or reach production.
- Common Vulnerabilities and Exposures (CVE)Common Vulnerabilities and Exposures (CVE) is the public catalog that gives each disclosed software or hardware vulnerability a unique ID such as CVE-2023-4966.
- Common Vulnerability Scoring System (CVSS)Common Vulnerability Scoring System (CVSS) is an open standard from FIRST that rates the severity of a software vulnerability from 0.0 to 10.0.
- Common Weakness Enumeration (CWE)Common Weakness Enumeration (CWE) is MITRE's catalog of the types of mistakes in software and hardware that lead to vulnerabilities, such as CWE-89 SQL injection or CWE-639 authorization bypass through a user-controlled key.
- Continuous penetration testingContinuous penetration testing is offensive testing that runs repeatedly on its own, triggered by a schedule, a release or a detected change, so new endpoints, roles and exposed services are tested for exploitable flaws within hours or days of appearing, not at the next annual engagement.
- Continuous security validationContinuous security validation is the practice of repeatedly running safe, simulated attack techniques against your own environment to prove whether exposures are actually exploitable and whether prevention and detection controls stop or flag them.
- Cross-site request forgery (CSRF)Cross-site request forgery (CSRF) is a vulnerability where a site the attacker controls makes a logged-in victim's browser send a state-changing request to another application, which accepts it because the browser attaches the victim's cookies automatically.
- Cross-site scripting (XSS)Cross-site scripting (XSS) is a vulnerability where an application places attacker-supplied input into a page without encoding it, so the victim's browser runs the attacker's JavaScript with the site's origin and can read the page, act as the logged-in user, or change what they see.
D
- Dependency confusionDependency confusion is a supply chain attack where an attacker publishes a package to a public registry under the same name as a company's internal package, usually with a higher version number, so build tools that consult both sources install the attacker's code and run it on developer machines and CI servers.
- Dynamic application security testing (DAST)Dynamic application security testing (DAST) is automated testing of a running web application or API from the outside: a scanner crawls the app, sends modified requests to each input, and flags responses that show injection, cross-site scripting, misconfiguration or exposed data, without access to source code.
E
G
I
- Instance metadata service (IMDS)The instance metadata service (IMDS) is a local HTTP endpoint at 169.254.169.254 that a cloud VM queries to learn about itself, including the temporary credentials of its attached role, which makes it the highest-value target for a server-side request forgery attack.
- Internal vs external penetration testingInternal and external penetration testing differ by starting position.
