Project: WASC Threat Classification

WASC Threat Classification 'Enumeration View'

This view enumerates the attacks, and weaknesses that can lead to the compromise of a website, its data, or its users. This serves as the base view for the WASC Threat Classification.

Grid Representation:

Tree Representation:

Attacks

• Abuse of Functionality
• Brute Force
• Buffer Overflow
• Content Spoofing
• Credential/Session Prediction
• Cross-Site Scripting
• Cross-Site Request Forgery
• Denial of Service
• Fingerprinting
• Format String
• HTTP Response Smuggling
• HTTP Response Splitting
• HTTP Request Smuggling
• HTTP Request Splitting
• Integer Overflows
• LDAP Injection
• Mail Command Injection
• Null Byte Injection
• OS Commanding
• Path Traversal
• Predictable Resource Location
• Remote File Inclusion (RFI)
• Routing Detour
• Session Fixation
• SOAP Array Abuse
• SSI Injection
• SQL Injection
• URL Redirector Abuse
• XPath Injection
• XML Attribute Blowup
• XML External Entities
• XML Entity Expansion
• XML Injection
• XQuery Injection

Weaknesses

• Application Misconfiguration
• Directory Indexing
• Improper Filesystem Permissions
• Improper Input Handling
• Improper Output Handling
• Information Leakage
• Insecure Indexing
• Insufficient Anti-automation
• Insufficient Authentication
• Insufficient Authorization
• Insufficient Password Recovery
• Insufficient Process Validation
• Insufficient Session Expiration
• Insufficient Transport Layer Protection
• Server Misconfiguration