You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious data because the allowed protocol format is not being checked, or duplicates are accepted, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats Read more about this topic in OWASP’s free Cheat Sheets on Input Validation, XSS Prevention, DOM-based XSS Prevention, SQL Injection Prevention, and Query Parameterization Data Validation & Encoding 4 Data Validation & Encoding 5 Data Validation & Encoding 6 Data Validation & Encoding 7 Dave can input malicious field names or data because it is not being checked within the context of the current user and process Jee can bypass the centralized encoding routines they are not being used everywhere, or the wrong encodings are being used Jason can bypass the centralized validation routines since they are not being used on all inputs Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed
Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized Darío can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as Darío can pretend to be Colin) Dennis has control over validation, output validation or output encoding code or routines so they can be bypassed Data Validation & Encoding Q Data Validation & Encoding K Geoff can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card)
Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently John can predict or guess session identifiers because they are not changed when the user's role alters (e.g. pre and post authentication) and when switching between non-encrypted and encrypted communications, or are not sufficiently long and random, or are not changed periodically Gary can take over a user's session because there is a long or no inactivity timeout, or a long or no overall session time limit, or the same session can be used from more than one device/location Casey can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session Session Management 8 Session Management 9 Session Management 10 Session Management J Matt can abuse long sessions because the application does not require periodic re-authentication to check if privileges have changed Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens (i.e. anti-CSRF tokens) or similar are not being used for actions that change state Jeff can resend an identical repeat interaction (e.g. HTTP request, signal, button press) and it is accepted, not rejected
Cryptography A Cryptography Cryptography 2 Cryptography 3 You have invented a new attack against Cryptography (no card) Kyun can access data because it has been obfuscated rather than using an approved cryptographic function Axel can modify transient or permanent data (stored or in transit), or source code, or updates/patches, or configuration data, because it is not subject to integrity checking Read more this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection Cryptography 4 Cryptography 5 Cryptography 6 Cryptography 7 can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify unencrypted data in memory or in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in use or in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication
Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code Cryptography Q Cryptography K Randolph can access or predict the master cryptographic secrets Dan can influence or alter cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them (no card) (no card)
Cornucopia A Cornucopia Cornucopia 2 Cornucopia 3 You have invented a new attack of any type (no card) Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Andrew can access source code, or decompile, or otherwise access business logic to understand how the application works and any secrets contained Read more application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model Cornucopia 4 Cornucopia 5 Cornucopia 6 Cornucopia 7 Keith can perform an action and it is not possible to attribute it to him Larry can influence the trust other parties including users have in the application, or abuse that trust elsewhere (e.g. in another application) can bypass controls because error/exception handling is missing, or is implemented inconsistently or partially, or does not deny access by default (i.e. errors should terminate access/execution), or relies on handling by some other service or system Mwengu's actions cannot be investigated because there is not an adequate accurately record of security events, or there is not a full audit trail, or these can be altered or deleted by Mwengu, or there is no centralized logging service
Cornucopia 8 Cornucopia 9 Cornucopia 10 Cornucopia J David can bypass the application to gain access to data because the network and host infrastructure, and supporting services/applications, have not been securely configured, the configuration rechecked periodically and security patches applied, or the data is stored locally, or the data is not physically protected Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately Xavier can circumvent the application's controls because code frameworks, libraries and components contain malicious code or vulnerabilities (e.g. commercial off the shelf, outsourced, open source, externally-located) Roman can exploit the application because it was compiled using out-of-date tools, or its configuration is not secure by default, or security information was not documented and passed on to operational teams Q K Joker Joker