Glossary

Umbrella for authorization failures: users can act outside intended permissions. Tops OWASP and bounty payout lists.

API authorization failure where object IDs are trusted without verifying the caller may access that object. Closely related to IDOR.

Browser rules for cross-site API access. Misconfiguration can let untrusted origins read sensitive responses.

Forcing a logged-in browser to send a state-changing request the user did not intend, if anti-forgery protections are missing.

Accessing another user’s object by changing an ID or key in a request without proper authorization checks. Often overlaps with BOLA in API contexts.

Sensitive data leaks via verbose errors, debug endpoints, backups, or forgotten assets. Often a beginner hunting class and a bridge to higher-impact bugs.

Reading or including files from the server filesystem via path control. Often tied to path traversal patterns.

Ability to run attacker-controlled code on a target system. Severe class of finding; keep testing authorized and report ethically.

Untrusted input reaches a SQL query in a way that changes its meaning. Less common in modern apps but still high impact when present.

Tricking a server into making requests to internal or unintended URLs. High reward density when found on bounty programs.

User input evaluated inside a template engine, which can escalate to code execution depending on the engine.

Injecting script into a page that runs in another user’s browser. Useful to understand for impact and defenses; high volume on bounty platforms.

Abuse of XML parsers that resolve external entities, potentially exposing files or triggering SSRF-like behavior.

Signed token format used for sessions and APIs. Watch algorithm confusion, weak secrets, and over-broad claims.

Delegated authorization framework. Redirect URI validation and token leakage are common bounty themes.

XML-based SSO protocol. Classic issues include signature wrapping and assertion tampering when validation is incomplete.

OWASP checklist of security requirements by level. Useful to structure deep testing beyond scanners.

Public identifier for a specific disclosed vulnerability. Distinct from a weakness class (CWE).

Catalog of software weakness types used to classify findings (e.g. CWE-79 for XSS).

OWASP how-to guide for testing mobile apps against MASVS controls in a lab-first way.

OWASP requirements for mobile app security. Paired with MASTG for testing techniques.

Community that publishes widely used AppSec standards and guides (Top 10, ASVS, testing guides, tooling).

Industry-standard intercepting proxy for web testing. Core skill for request inspection, replay, and authorized assessments.

Template-based vulnerability scanner used for fast, repeatable checks during recon—not a substitute for logic testing.

Evidence that a vulnerability is real. hackingDNA stays methodology-focused and does not generate weaponized exploit payloads.

Program that accepts vulnerability reports, often without monetary bounties. Still requires staying in scope and authorized testing.