Education
Understand common vulnerabilities and how to prevent them
Click on a vulnerability to learn more about it
SQL Injection occurs when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
XSS attacks occur when an application includes untrusted data in a web page without proper validation or escaping. Attackers can execute scripts in the victim's browser to hijack sessions, deface websites, or redirect users.
CSRF attacks force end users to execute unwanted actions on a web application where they're authenticated. By tricking users into clicking malicious links or loading malicious pages, attackers can perform actions on behalf of victims.
IDOR occurs when an application uses user-supplied input to access objects directly without proper authorization checks. Attackers can access unauthorized data by modifying parameter values.
Path traversal attacks exploit insufficient security validation to access files outside the intended directory. Using sequences like "../" attackers can navigate to sensitive system files.
JWT vulnerabilities occur when JSON Web Tokens are improperly implemented. Common issues include accepting "none" algorithm, weak secrets, and improper signature verification.
Command injection occurs when an application passes unsafe user data to a system shell. Attackers can execute arbitrary commands on the host operating system.