CSRF, XXE, and 12 Other Security Acronyms Explained
Tags: security, webdev, programming, devops
Published: 2022-07-12 08:59:30

Acronyms are shortcuts, and we love using them, specially the catchy ones! Let's decipher some commonly used acronyms in the cyber security industry.

## OWASP
The **Open Web Application Security Project (OWASP)** is a nonprofit foundation that works to improve the security of software. The OWASP Top 10 is one their popular projects.

## XSS
It stands for **Cross-Site Scripting**. An X is used instead of the C to prevent confusion with Cascading Style Sheets (CSS).

> [Read more about Cross-Site Scripting vulnerability](https://www.thesmartscanner.com/vulnerability-list/cross-site-scripting)

## SQLI
**SQL Injection**, is an attack where the SQL commands used in an application are manipulated by attacker. SQLI is a dangerous and common vulnerability. [Find SQL Injection on your website](https://www.thesmartscanner.com/) with SmartScanner now.

> [Read more about SQL Injection vulnerability](https://www.thesmartscanner.com/vulnerability-list/sql-injection)

## RCE
**Remote Command Execution** (RCE) is a high-risk vulnerability. It can occur anywhere from routers to online shops. By exploiting RCE, an attacker can execute commands (usually OS commands) on the target system.

> [Read more about Remote Command Execution vulnerability](https://www.thesmartscanner.com/vulnerability-list/os-command-execution)

## DoS and DDos
**Denial of Service** (DoS) is a famous security acronym. You might have heard it at the news. DoS is a type of attack that makes the target service unavailable. Attackers usually perform DoS attacks by sending enormous traffic to the target.

**Distributed Denial of Service** (DDoS) is a DoS attack from many different sources. This type of DoS typically runs using zombie botnets.


![Results of a Denial of Service Attack](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w89u2gqufmshslslzcpa.png)

## CSRF
CSRF (pronounce Sea Surf) stands for **Cross-Site Request Forgery**. CSRF (aka XSRF) is an attack where the attacker sends a request on behalf of a victim user without her knowledge. Attackers exploit CSRF to do actions using the victim's permission. For example, a hacker can create an admin user for himself using a CSRF attack.

## XXE
An **XML External Entity** attack is a kind of attack against an application that parses XML input. In this attack, the vulnerable application processes a reference to an external entity in the provided XML. The XXE is a dangerous attack that can lead to information disclosure or denial of service attacks.

## SSRF
In a **Server-Side Request Forgery** (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources.

## SSI
A **Server-Side Includes Injection** is a type of security attack that exploits the Service-side Includes features of a web server. The *Server-side includes* are tags in HTML files. The web server executes these tags to add dynamic contents to the page before sending it to the user.

## RFI
**Remote File Inclusion** (RFI) occurs when the web application downloads and executes a remote file. This remote file is usually controlled by an attacker and is passed as a request parameter.

> [Read more about Remote File Inclusion vulnerability](https://www.thesmartscanner.com/vulnerability-list/remote-file-inclusion)

## LFI / LFD
**Local File Inclusion** (LFI) is similar to a remote file inclusion vulnerability, but only local files on the server can be included for execution. It does not mean the LFI is less dangerous than RFI.


![Local File Inclusion and Path Traversal Payload Variations](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4olhd1kuxkzd3ufkrupr.png)

When the local file is only opened and sent back to the user (or attacker), it is called **Local File Download** or **Disclosure**.

> [Read more about Local File Inclusion](https://www.thesmartscanner.com/vulnerability-list/local-file-inclusion)

## IDOR
IDOR stands for **Insecure Direct Object Reference**. It is a vulnerability that occurs when a reference to an internal object, such as a file or directory, is retrieved from user-supplied input. If no proper authorization is implemented, an attacker can abuse this reference to access every object.

## CVE
The **Common Vulnerabilities and Exposures** (CVE) system provides a mechanism for referencing publicly known security vulnerabilities.

## CWE
The **Common Weakness Enumeration** (CWE) is a category system for hardware and software weaknesses and vulnerabilities.