PT+ 8 · Web, Cloud & Token Attacks

Blind SQL injection (boolean, time-based)

SQL injection where the application returns neither query results nor errors, so the attacker infers data from behavior. Confused with: Error-based SQL injection; Union-based SQL injection.

Command injection

An attack where user input reaches an operating-system shell, so the attacker runs arbitrary commands with the application's privileges. Confused with: Code injection; SQL injection.

PHP: system() function

A built-in PHP function that hands a string to the operating system shell and returns the output. Confused with: PHP code evaluation; Local and remote file inclusion.

Code injection

An attack that gets attacker-supplied code run by the application's own language interpreter, such as PHP or Python code evaluated on the server. Confused with: Command injection; Cross-site scripting (XSS).

Arbitrary code execution

Running attacker-chosen code on a target system, which is called remote code execution when launched from a remote location. Confused with: Privilege escalation; Command injection.

LDAP injection

An attacker supplies crafted filter syntax in an input field so the application builds an altered directory query, often bypassing authentication or exposing directory entries. Confused with: SQL injection; Command injection.

HTML injection

Inserting attacker-controlled HTML markup into a page because user input is not sanitized or encoded. Confused with: Cross-site scripting (XSS); SQL injection.

Server-side template injection (SSTI)

User input is inserted into a server-side template and evaluated by the template engine, which can expose server objects and often leads to remote code execution. Confused with: Cross-site scripting; Command injection.

Cross-site scripting (XSS)

Injection of attacker script into a page that other users view, so it runs in their browsers with the site's trust. Confused with: Cross-site request forgery (CSRF); HTML injection.

Server-side request forgery (SSRF)

A web application flaw where an attacker makes the server send requests to internal or otherwise trusted resources, such as internal services or cloud metadata endpoints. Confused with: Cross-site request forgery; Remote file inclusion.

API abuse

Misusing an API, most simply by calling endpoints that lack authentication or authorization so anyone can read or change the data behind them. Confused with: Insecure direct object reference (IDOR); JWT manipulation.

Session hijacking

Taking over a user's authenticated session by stealing or predicting its session token, so the attacker is treated as that user without ever knowing the password. Confused with: Session fixation; Cross-site request forgery.

Session Fixation

The attacker gets a victim to authenticate using a session ID the attacker already knows, then reuses that ID to hijack the logged-in session. Confused with: Session hijacking; Cross-site request forgery.

Session tokens

Secret identifiers, usually stored in cookies, that tell a server a request belongs to an authenticated session. Confused with: API key; JSON Web Token.

Register manipulation

An exploitation technique that overwrites CPU register values, most importantly the instruction pointer, so execution jumps to attacker-chosen code. Confused with: Buffer overflow; Return-oriented programming.

Race condition

A flaw where the outcome depends on the unpredictable timing or order of concurrent operations, letting an attacker slip in between a check and its use. Confused with: Buffer overflow; Business logic flaw.

ASLR

Address Space Layout Randomization randomizes where a program's code, stack, heap and libraries load in memory on each run, so exploits cannot rely on fixed addresses. Confused with: DEP or NX; Stack canary.

SAML and OIDC attacks

Attacks on federated single sign-on, where an attacker forges, tampers with or steals SAML assertions or OIDC tokens to impersonate users. Confused with: OAuth; Kerberos ticket attacks.

JWT manipulation

JSON Web Tokens carry a header, claims and signature used for web authentication. Confused with: Session hijacking; Insecure direct object reference (IDOR).

Primary Refresh Token (PRT)

A long-lived token Azure AD issues to a joined device and user to prove identity and enable single sign-on across apps. Confused with: Kerberos ticket-granting ticket; OAuth access token.

IAM misconfigurations

Cloud identities hold attached permissions that workloads or users assume, so overly broad roles, wildcard policies or stolen role credentials give an attacker that access. Confused with: Metadata service attacks; Resource misconfiguration.

Exposed storage buckets

Cloud object storage, such as an S3 bucket, left readable or writable by the public or other accounts because its resource-based access policy is too permissive. Confused with: IAM identity-based policy; Security group rules.

Third-party integrations

External SaaS applications or vendor connections granted access to a cloud account through OAuth grants, API keys or cross-account roles. Confused with: Supply chain attacks; Resource misconfiguration.

Sensitive data exposure

A weakness where an application unintentionally reveals personal or confidential data, for example through missing encryption, verbose responses or public storage. Confused with: Data breach; Broken access control.

Container escape

Breaking out of a container's isolation to reach the host, through a misconfiguration such as a privileged container or exposed Docker socket. Confused with: Metadata service attacks; Docker Bench.

Workload runtime attacks

Malicious activity against a container or workload while it is running, such as exploiting the application inside it, abusing mounted secrets or escaping to the host. Confused with: Container image vulnerabilities; Orchestrator control-plane attacks.

Image and artifact tampering

Modifying container or VM images in a registry or build pipeline so that malicious code is deployed along with trusted software. Confused with: Container escape; Dependency confusion.

Supply chain attacks

Compromising a vendor, software dependency, update channel or build process to reach many downstream targets at once. Confused with: Trust relationship abuse; Watering hole attack.

Cloud malware injection

An attack that inserts malicious code or a rogue service instance into a cloud application or workload, so the platform runs attacker code as if it were legitimate. Confused with: Side-channel attack; Direct-to-origin attack.