Glossary

Quick definitions for the security terms used throughout our lessons.

A

Access Control: The mechanisms that determine who is allowed to do what within an application, evaluated on every request.
Authentication: The process of verifying who a user is, typically via a password, token, or other credential.
Authorization: The process of verifying what an already-authenticated user is permitted to do or access.

BOLA (Broken Object Level Authorization): The API-specific name for IDOR — a missing check confirming the caller is permitted to access a specific object.
Brute Force Attack: Systematically trying many credential combinations until one succeeds, rather than exploiting a logic flaw.

Command Injection: A vulnerability where user input is passed unsafely into an operating system shell command, letting an attacker run arbitrary commands.
CORS (Cross-Origin Resource Sharing): A browser mechanism that lets a server explicitly permit specific other origins to read its responses, relaxing the Same-Origin Policy under controlled conditions.
Credential Stuffing: Using username/password pairs leaked from one breach to attempt logins on unrelated services, exploiting password reuse.
CSRF (Cross-Site Request Forgery): Tricking a victim's authenticated browser into sending a state-changing request the victim never intended.
CVSS: Common Vulnerability Scoring System — a standardized way of rating how severe a vulnerability is.

Deserialization: Converting serialized data back into an object; unsafe deserialization of untrusted input can lead to remote code execution.
Direct Object Reference: An identifier (like a database row ID or filename) exposed directly to the client, which IDOR vulnerabilities exploit when unchecked.
DOM-Based XSS: A form of XSS where the vulnerable data flow happens entirely in client-side JavaScript, without the malicious payload ever touching the server.

Fail-Open / Fail-Closed: Whether a system defaults to allowing access (fail-open, dangerous) or denying it (fail-closed, safe) when a check errors or is misconfigured.

HttpOnly: A cookie attribute that prevents JavaScript from reading the cookie's value, reducing the impact of XSS on session theft.

IDOR (Insecure Direct Object Reference): A vulnerability where an application lets a user access an object by supplying its reference directly, without verifying they're authorized to.
Injection: A broad vulnerability class where untrusted input is interpreted as code or commands by an interpreter (SQL, OS shell, LDAP, etc.) instead of as plain data.

JWT (JSON Web Token): A compact, signed token format commonly used to carry authentication and session data without server-side storage.

Least Privilege: The principle that every user, process, or system should have only the minimum access necessary to do its job.
LFI (Local File Inclusion): A vulnerability where an application includes and executes a local file chosen by the attacker, often via path traversal.

Mass Assignment: A vulnerability where an application binds an entire request payload to a model without restricting which fields are allowed, letting an attacker set fields they shouldn't control.
MFA (Multi-Factor Authentication): Requiring more than one independent factor (something you know, have, or are) to authenticate.

OAuth: An authorization framework that lets a user grant a third-party application limited access to their resources without sharing their password.
Open Redirect: A vulnerability where an application redirects to a URL controlled by an attacker, often abused for phishing.
OWASP: Open Worldwide Application Security Project — a nonprofit best known for the OWASP Top 10, a widely referenced list of critical web application risks.

Path Traversal: A vulnerability where manipulating a file path (e.g. with "../") lets an attacker access files outside the intended directory.
Payload: The specific input crafted to trigger or exploit a vulnerability.
Penetration Testing: Authorized, simulated attacks against a system to identify exploitable vulnerabilities before a real attacker does.
Privilege Escalation: Gaining access beyond what was originally granted — horizontally (another user's data) or vertically (higher-privileged functionality).

Race Condition: A bug arising from the timing of concurrent operations, where two simultaneous requests interact in an unintended way.
Rate Limiting: Restricting how many requests a client can make in a given time window, used to blunt brute-force, scraping, and abuse.
RCE (Remote Code Execution): A vulnerability that lets an attacker run arbitrary code on a target system — typically the most severe possible outcome.
Responsible Disclosure: Privately reporting a discovered vulnerability to the affected organization and giving them reasonable time to fix it before any public disclosure.

Same-Origin Policy (SOP): The browser rule preventing a script on one origin from reading responses from a different origin.
SameSite: A cookie attribute controlling whether a cookie is sent on cross-site requests, a key defense against CSRF.
Session Fixation: Forcing a victim to use a session identifier the attacker already knows, so the attacker can hijack the session once the victim authenticates.
Session Hijacking: Taking over a victim's active session, typically by stealing their session identifier.
SQL Injection: A vulnerability where untrusted input is concatenated into a SQL query, letting an attacker alter the query's logic or extract data.
SSRF (Server-Side Request Forgery): A vulnerability where an attacker tricks a server into making requests to unintended destinations, often internal-only systems.
SSTI (Server-Side Template Injection): A vulnerability where user input is evaluated as a template expression on the server, potentially leading to code execution.

Threat Model: A structured analysis of what could go wrong in a system — who might attack it, how, and what the impact would be.
TLS (Transport Layer Security): The protocol that encrypts traffic between a client and server, commonly still referred to by its predecessor's name, SSL.

WAF (Web Application Firewall): A filtering layer sitting in front of a web application that inspects and blocks requests matching known attack patterns.

XXE (XML External Entity): A vulnerability where a misconfigured XML parser resolves external entities, potentially disclosing local files or enabling SSRF.
XSS (Cross-Site Scripting): A vulnerability where untrusted input is rendered as executable script in a victim's browser.

Zero-Day: A vulnerability that is publicly known or being exploited before the vendor has released a fix.