Knowledge Base

Broken Authentication encompasses flaws in authentication mechanisms that allow attackers to compromise passwords, session tokens, or exploit implementation flaws to assume other users' identities.

Hardcoded credentials occur when passwords, API keys, cryptographic keys, or other secrets are embedded directly in source code, configuration files, or build artifacts, making them accessible to anyone with code access.

OS Command Injection occurs when an application passes unsanitized user input to a system shell, allowing attackers to execute arbitrary commands on the host operating system. Learn how to detect and prevent command injection across languages.

SQL Injection occurs when untrusted input is concatenated into SQL queries, allowing attackers to read, modify, or delete database contents. Learn how to detect and prevent SQLi across languages.

XSS occurs when applications include untrusted data in web pages without proper encoding, allowing attackers to execute malicious scripts in victims' browsers.

Server-Side Request Forgery occurs when an attacker can make a server-side application send HTTP requests to an attacker-chosen destination, enabling access to internal services, cloud metadata, and internal networks.

XML External Entity (XXE) injection occurs when an application parses XML input containing references to external entities, allowing attackers to read local files, perform SSRF, or cause denial of service.

Insecure Deserialization occurs when an application deserializes untrusted data without validation, potentially allowing attackers to execute arbitrary code, tamper with application logic, or perform denial-of-service attacks.

Path Traversal (Directory Traversal) allows attackers to access files outside the intended directory by manipulating file path inputs with sequences like ../. Learn how to detect and prevent path traversal across languages.

Insecure cryptography occurs when applications use outdated, broken, or improperly configured cryptographic algorithms, making encrypted data vulnerable to decryption, tampering, or forgery.