Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

Application security conceptIntermediate

Web Application Attack Classes

Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.

Framework mapping

MITRE ATT&CK® Enterprise mapping

Catalog v19.2
techniqueT1190 — Exploit Public-Facing Application

Tactics: Initial Access

Platforms: Windows, Linux, IaaS, Network Devices, Containers, ESXi

Relationship: application-security context

Open the official ATT&CK object ↗

Editorial mapping of an inherited BMC article to related Enterprise ATT&CK behavior, control, evidence, architecture, or risk context. Mapping roles state the relationship and do not assert equivalence unless labeled direct.

What it means

The exact names change across taxonomies, but the underlying issue is how untrusted input, identity, authorization, state, and business logic cross trust boundaries.

Why it matters

Understanding attack classes helps teams design controls and testing strategies that address causes rather than one vulnerable URL.

Practical focus

  • Validate authorization on every sensitive action
  • Treat all client-controlled input as untrusted
  • Protect sessions and state transitions
  • Test business logic as well as technical inputs

Common mistakes

  • Focusing only on input validation
  • Assuming a hidden interface is inaccessible
  • Fixing one occurrence without finding the underlying pattern

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

CompTIA PenTest+CompTIA CySA+CompTIA Security+

Authoritative sources