Threat Landscape and Common Vulnerabilities

Author : Bisgaard Vangsgaard | Published On : 22 Oct 2025

# Chapter four: Threat Landscape and Common Vulnerabilities
Each application operates within a setting full of threats – destructive actors constantly searching for weaknesses to exploit. Understanding the menace landscape is vital for defense. In this chapter, we'll survey the almost all common forms of app vulnerabilities and episodes seen in typically the wild today. You will discuss how these people work, provide practical instances of their exploitation, and introduce greatest practices to prevent these people. This will lay down the groundwork at a later time chapters, which will certainly delve deeper directly into how to construct security in to the development lifecycle and specific defenses.

Over the many years, certain categories regarding vulnerabilities have come about as perennial issues, regularly appearing in security assessments and breach reports. Market resources like the OWASP Top 10 (for web applications) and even CWE Top twenty-five (common weaknesses enumeration) list these normal suspects. Let's discover some of the major ones:

## Injection Attacks (SQL, Command Injection, and many others. )
- **Description**: Injection flaws occur when an app takes untrusted insight (often from an user) and nourishes it into a great interpreter or command in a manner that alters the intended execution. The particular classic example is usually SQL Injection (SQLi) – where customer input is concatenated into an SQL query without right sanitization, allowing the user to put in their own SQL commands. Similarly, Order Injection involves treating OS commands, LDAP Injection into LDAP queries, NoSQL Shot in NoSQL databases, and so about. Essentially, the applying does not work out to distinguish information from code instructions.

- **How that works**: Consider a simple login kind that takes an username and password. If typically the server-side code naively constructs a question such as: `SELECT * BY users WHERE login name = 'alice' AND password = 'mypassword'; `, an attacker can input anything like `username: alice' OR '1'='1` and even `password: anything`. The cake you produced SQL would get: `SELECT * FROM users WHERE login = 'alice' OR '1'='1' AND pass word = 'anything'; `. The `'1'='1'` problem always true can make the query return all consumers, effectively bypassing the particular password check. This is a simple sort of SQL treatment to force a login.
More maliciously, an attacker can terminate the issue and add `; FALL TABLE users; --` to delete the particular users table (a destructive attack upon integrity) or `; SELECT credit_card COMING FROM users; --` to dump sensitive data (a confidentiality breach).
- **Real-world impact**: SQL injection features been behind a few of the largest data removes on record. We mentioned the Heartland Payment Systems break – in 08, attackers exploited a great SQL injection in the web application to be able to ultimately penetrate inside systems and take millions of credit score card numbers​
TWINGATE. COM
. Another case: the TalkTalk 2015 breach in britain, where a teenager used SQL injection to reach the personal info of over one hundred fifty, 000 customers. Typically the subsequent investigation unveiled TalkTalk had left an obsolete website with a known SQLi flaw on the internet, and hadn't patched a database susceptability from 2012​
ICO. ORG. UK
​
ICO. ORG. UK
. TalkTalk's CEO detailed it as some sort of basic cyberattack; without a doubt, SQLi was well-understood for a decade, yet the company's failure to sterilize inputs and upgrade software led to some sort of serious incident – they were fined and suffered reputational loss.
These illustrations show injection episodes can compromise privacy (steal data), sincerity (modify or erase data), and availability (if data is wiped, service is disrupted). Even nowadays, injection remains the common attack vector. In fact, OWASP's 2021 Top Five still lists Injections (including SQL, NoSQL, command injection, and so forth. ) as a leading risk (category A03: 2021)​
IMPERVA. APRESENTANDO
.
- **Defense**: The primary defense against injection is type validation and end result escaping – ensure that any untrusted information is treated simply because pure data, never as code. Employing prepared statements (parameterized queries) with sure variables is a new gold standard intended for SQL: it separates the SQL program code through the data beliefs, so even if an user enters a weird line, it won't crack the query structure. For example, utilizing a parameterized query throughout Java with JDBC, the previous login query would be `SELECT * FROM users WHERE login =? AND security password =? `, in addition to the `? ` placeholders are bound to user inputs safely and securely (so `' OR PERHAPS '1'='1` would end up being treated literally because an username, which often won't match any real username, rather than part associated with SQL logic). Identical approaches exist intended for other interpreters.
About top of that will, whitelisting input acceptance can restrict exactly what characters or format is allowed (e. g., an username could possibly be restricted to alphanumeric), stopping numerous injection payloads with the front door​
IMPERVA. COM
. In addition, encoding output properly (e. g. HTML encoding to prevent script injection) is usually key, which we'll cover under XSS.
Developers should never directly include organic input in directions. Secure frameworks in addition to ORM (Object-Relational Mapping) tools help by simply handling the question building for a person. Finally, least benefit helps mitigate effects: the database bank account used by typically the app should include only necessary benefits – e. g. it will not have got DROP TABLE rights if not required, to prevent the injection from undertaking irreparable harm.

## Cross-Site Scripting (XSS)
- **Description**: Cross-Site Scripting identifies some sort of class of vulnerabilities where an software includes malicious scripts in the context of a trusted site. Unlike injection straight into a server, XSS is about treating into the content of which others see, usually inside a web site, causing victim users' browsers to execute attacker-supplied script. Right now there are a couple of types of XSS: Stored XSS (the malicious script is usually stored on the server, e. g. within a database, and even served to additional users), Reflected XSS (the script is usually reflected from the hardware immediately within a response, often via a research query or problem message), and DOM-based XSS (the vulnerability is in client-side JavaScript that insecurely manipulates the DOM).

- **How this works**: Imagine a communication board where consumers can post comments. If the app is not going to sanitize CODE tags in comments, an attacker could post a comment like: ` `. Any end user who views that comment will by mistake run the software in their browser. The script over would send the user's session sandwich to the attacker's server (stealing their own session, hence enabling the attacker to impersonate them in the site – a confidentiality and integrity breach).
Inside a reflected XSS scenario, maybe the web site shows your insight with an error page: should you pass some sort of script in typically the URL and the site echoes it, that will execute inside the browser of the person who clicked that destructive link.
Essentially, XSS turns the victim's browser into a good unwitting accomplice.
- **Real-world impact**: XSS can be quite serious, especially in highly trusted websites (like social networks, webmail, banking portals). A new famous early instance was the Samy worm on MySpace in 2005. An individual can named Samy uncovered a stored XSS vulnerability in Bebo profiles. He created a worm: a new script that, any time any user looked at his profile, this would add him or her as a friend and copy the particular script to the viewer's own account. Like that, anyone otherwise viewing their profile got infected also. Within just twenty hours of release, over one thousand users' profiles acquired run the worm's payload, making Samy among the fastest-spreading viruses of all time​
SOBRE. WIKIPEDIA. ORG
. The worm itself simply displayed the term "but most of all, Samy is my hero" upon profiles, a relatively harmless prank​
SOBRE. WIKIPEDIA. ORG
. Nevertheless, it absolutely was a wake-up call: if a great XSS worm could add friends, it could just just as easily have stolen non-public messages, spread junk e-mail, or done various other malicious actions on behalf of customers. Samy faced legitimate consequences for this kind of stunt​
EN. WIKIPEDIA. ORG
.
In one more scenario, XSS could be used to hijack accounts: intended for instance, a mirrored XSS inside a bank's site may be used via a scam email that methods an user in to clicking an LINK, which then completes a script to be able to transfer funds or even steal session tokens.
XSS vulnerabilities need been found in internet sites like Twitter, Facebook or myspace (early days), plus countless others – bug bounty plans commonly receive XSS reports. While many XSS bugs are regarding moderate severity (defaced UI, etc. ), some may be important if they permit administrative account takeover or deliver spyware and adware to users.
- **Defense**: The foundation of XSS protection is output coding. Any user-supplied written content that is exhibited within a page ought to be properly escaped/encoded so that this should not be interpreted because active script. Intended for example, if a consumer writes ` ` in an opinion, the server need to store it then output it while `< script> bad()< /script> ` thus that it shows up as harmless text, not as a good actual script. Modern web frameworks usually provide template machines that automatically escape variables, which prevents most reflected or even stored XSS simply by default.
Another essential defense is Content material Security Policy (CSP) – a header that instructs browsers to execute intrigue from certain options. A well-configured CSP can mitigate typically the impact of XSS by blocking inline scripts or outside scripts that aren't explicitly allowed, though CSP may be intricate to set right up without affecting blog functionality.
For programmers, it's also essential to stop practices like dynamically constructing HTML with raw info or using `eval()` on user suggestions in JavaScript. Internet applications can also sanitize input in order to strip out banned tags or qualities (though this is certainly challenging to get perfect). In summary: confirm and sanitize virtually any HTML or JavaScript inputs, use context-appropriate escaping (HTML escape for HTML content material, JavaScript escape regarding data injected in to scripts, etc. ), and consider allowing browser-side defenses like CSP.

## Busted Authentication and Treatment Management
- **Description**: These vulnerabilities include weaknesses in precisely how users authenticate to be able to the application or perhaps maintain their authenticated session. "Broken authentication" can mean a number of issues: allowing weakened passwords, not avoiding brute force, faltering to implement correct multi-factor authentication, or perhaps exposing session IDs. "Session management" is closely related – once an user is logged inside of, the app usually uses a session cookie or token to remember them; if that mechanism is certainly flawed (e. grams. predictable session IDs, not expiring lessons, not securing typically the cookie), attackers may hijack other users' sessions.

- **How it works**: Single common example will be websites that enforced overly simple pass word requirements or acquired no protection in opposition to trying many accounts. Attackers exploit this particular by using abilities stuffing (trying username/password pairs leaked from the other sites) or incredible force (trying several combinations). If presently there are not any lockouts or even rate limits, a good attacker can systematically guess credentials.
One more example: if the application's session cookie (the piece of files that identifies some sort of logged-in session) is usually not marked together with the Secure flag (so it's sent above HTTP as effectively as HTTPS) or even not marked HttpOnly (so it can easily be accessible in order to scripts), it may be thieved via network sniffing at or XSS. When an attacker offers a valid session token (say, lost from an unconfident Wi-Fi or by way of an XSS attack), they can impersonate that will user without seeking credentials.
There have got also been common sense flaws where, with regard to instance, the password reset functionality is usually weak – maybe it's prone to a great attack where an attacker can reset someone else's username and password by modifying parameters (this crosses in to insecure direct object references / access control too).
General, broken authentication covers anything that permits an attacker in order to either gain recommendations illicitly or bypass the login using some flaw.
rapid **Real-world impact**: We've all seen information of massive "credential dumps" – great of username/password sets floating around from past breaches. Assailants take these and try them on other services (because lots of people reuse passwords). This automated abilities stuffing has brought to compromises involving high-profile accounts about various platforms.
One of broken auth was the case in the summer season where LinkedIn experienced a breach in addition to 6. 5 thousand password hashes (unsalted SHA-1) were leaked​
NEWS. SOPHOS. POSSUINDO
​
NEWS. SOPHOS. POSSUINDO
. The weak hashing meant opponents cracked most regarding those passwords inside hours​
NEWS. SOPHOS. COM
​
MEDIA. SOPHOS. POSSUINDO
. More serious, a few decades later it flipped out the breach was actually a lot larger (over 100 million accounts). People often reuse passwords, so that break had ripple outcomes across other web sites. https://docs.joern.io/code-property-graph/ failing was initially in cryptography (they didn't salt or even use a solid hash), which is definitely portion of protecting authentication data.
Another standard incident type: session hijacking. For case in point, before most internet sites adopted HTTPS almost everywhere, attackers on a single community (like an open Wi-Fi) could sniff pastries and impersonate consumers – a menace popularized from the Firesheep tool in 2010, which often let anyone eavesdrop on unencrypted periods for sites want Facebook. This required web services to be able to encrypt entire periods, not just logon pages.
There have also been cases of flawed multi-factor authentication implementations or login bypasses due to reasoning errors (e. h., an API that returns different emails for valid vs invalid usernames may allow an attacker to enumerate users, or possibly a poorly executed "remember me" token that's easy in order to forge). The results regarding broken authentication will be severe: unauthorized gain access to to user accounts, data breaches, identity theft, or not authorized transactions.
- **Defense**: Protecting authentication needs a multi-pronged approach:
instructions Enforce strong security password policies but inside reason. Current NIST guidelines recommend letting users to choose long passwords (up to 64 chars) and never requiring recurrent changes unless there's indication of compromise​
JUMPCLOUD. COM
​
AUDITBOARD. COM
. As an alternative, check passwords against known breached password lists (to disallow "P@ssw0rd" and typically the like). Also inspire passphrases that happen to be simpler to remember nevertheless hard to guess.
- Implement multi-factor authentication (MFA). The password alone is often too few these kinds of days; providing a choice (or requirement) for the second factor, as an one-time code or a push notification, considerably reduces the risk of account compromise even if account details leak. Many key breaches could have been mitigated simply by MFA.
- Safe the session tokens. Use the Safe flag on cookies so they usually are only sent above HTTPS, HttpOnly so they aren't available via JavaScript (mitigating some XSS impact), and consider SameSite to prevent all of them from being delivered in CSRF problems (more on CSRF later). Make program IDs long, arbitrary, and unpredictable (to prevent guessing).
- Avoid exposing session IDs in URLs, because they can be logged or leaked via referer headers. Always prefer cookies or authorization headers.
- Implement consideration lockout or throttling for login tries. After say 5-10 failed attempts, both lock the take into account a period or perhaps increasingly delay answers. Utilize CAPTCHAs or even other mechanisms in the event that automated attempts will be detected. However, become mindful of denial-of-service – some web pages opt for better throttling to stay away from letting attackers lock out users simply by trying bad security passwords repeatedly.
- Treatment timeout and logout: Expire sessions after a reasonable period associated with inactivity, and absolutely invalidate session as well on logout. It's surprising how several apps in typically the past didn't effectively invalidate server-side session records on logout, allowing tokens being re-used.
- Be aware of forgot password goes. Use secure bridal party or links via email, don't expose whether an end user exists or not necessarily (to prevent end user enumeration), and guarantee those tokens terminate quickly.
Modern frameworks often handle a lot of this particular for you, but misconfigurations are normal (e. g., a developer might accidentally disable a new security feature). Standard audits and assessments (like using OWASP ZAP or additional tools) can capture issues like missing secure flags or perhaps weak password procedures.
Lastly, monitor authentication events. Unusual patterns (like just one IP trying 1000s of usernames, or one accounts experiencing hundreds of hit a brick wall logins) should lift alarms. This overlaps with intrusion diagnosis.
To emphasize, OWASP's 2021 list calls this category Identification and Authentication Disappointments (formerly "Broken Authentication") and highlights the particular importance of things such as MFA, not making use of default credentials, and even implementing proper security password handling​
IMPERVA. POSSUINDO
. They note of which 90% of applications tested had challenges in this area in some form, which is quite scary.

## Security Misconfiguration
- **Description**: Misconfiguration isn't just one vulnerability per se, nevertheless a broad course of mistakes throughout configuring the app or its environment that lead to insecurity. This can involve using default credentials or options, leaving unnecessary benefits enabled, misconfiguring protection headers, delete word hardening the server. Fundamentally, the software could possibly be secure in concept, but the way it's deployed or set up opens a pit.

- **How it works**: Examples associated with misconfiguration:
- Leaving default admin accounts/passwords active. Many software program packages or products historically shipped using well-known defaults