AppSec Playbook

Malicious scripts are injected into web pages viewed by other users, enabling session hijacking, credential theft, and DOM manipulation.

Weaknesses in authentication mechanisms allow attackers to compromise passwords, session tokens, or exploit flawed implementation to assume other users' identities.

Users can act outside of their intended permissions, accessing other users' data, modifying records, or performing privileged actions.

Sensitive data such as PII, financial records, or credentials is exposed through inadequate encryption, insecure transmission, or improper storage.

Insecure default configurations, incomplete setups, open cloud storage, verbose error handling, or misconfigured HTTP headers expose the application to attack.

An attacker tricks an authenticated user into submitting a forged request, causing the application to execute unwanted state-changing actions on the victim's behalf.

An attacker induces the server to make HTTP requests to an arbitrary domain or internal resource, potentially exposing cloud metadata, internal services, or sensitive data.

An attacker executes arbitrary commands on the host server by exploiting vulnerabilities in OS command construction, deserialization, template engines, or dependency vulnerabilities.

An attacker manipulates file path parameters using sequences like `../` to access files and directories outside the intended scope, including sensitive system files.

Attackers exploit XML parsers with external entity processing enabled to read local files, perform SSRF, or cause denial of service through entity expansion attacks.

Deserialization of untrusted data leads to remote code execution, authentication bypass, privilege escalation, or replay attacks when object graphs are reconstructed without validation.

APIs expose excessive data, lack authentication, allow unrestricted method access, or have missing rate limiting - enabling data harvesting, privilege abuse, and account takeover.

Attackers compromise third-party dependencies, build pipelines, or software distribution channels to inject malicious code that executes in downstream environments.

Using leaked username/password pairs from previous breaches, attackers automate login attempts across services exploiting password reuse to take over valid accounts.

An attacker injects malicious LDAP statements through unsanitized input fields, enabling unauthorized directory queries, authentication bypass, and data exfiltration from LDAP servers.

An application accepts untrusted user input for redirect destinations without validation, allowing attackers to redirect victims to malicious sites for phishing or credential theft.

An attacker embeds the target application in a transparent iframe overlaid on a decoy page, tricking users into clicking hidden UI elements and performing unintended actions.

Attackers overwhelm application resources through volumetric traffic floods, resource exhaustion, or application-layer abuse, rendering the service unavailable to legitimate users.

Attackers exploit flaws in the application's business workflow, such as skipping payment steps, manipulating prices, or abusing multi-step processes to achieve unauthorized outcomes.

Attackers manipulate JavaScript object prototypes through crafted input, affecting all objects that inherit from the polluted prototype and enabling property injection, denial of service, or remote code execution.

Dangling DNS records pointing to unclaimed cloud resources allow attackers to register those resources and serve malicious content under the victim's domain, enabling phishing, cookie theft, and CORS bypass.

Manipulating cache key inputs causes servers to store and serve malicious responses to other users, enabling cross-site scripting, open redirect injection, and security header bypass.

User input embedded in server-side templates is evaluated as template code, enabling remote code execution, file read, and full server compromise through template engine features.

Attackers gain unauthorized access to user accounts through credential stuffing, password reset abuse, session hijacking, or social engineering, enabling data theft, financial fraud, and further compromise.

Malicious encryption of critical systems and data by threat actors demanding payment for decryption keys, causing operational disruption, data loss, and potential regulatory exposure.

API keys, tokens, or secrets exposed in source code repositories, client-side applications, logs, or error messages enable unauthorized access to third-party services and internal systems.

A vendor, supplier, or partner experiences a security breach that exposes your organisation's data, creating regulatory obligations, reputational damage, and potential downstream compromise.

Current or former employees, contractors, or business partners misuse their authorized access to steal data, sabotage systems, or facilitate external attacks against the organisation.

Attackers gain unauthorized access to CI/CD pipelines, inject malicious code into builds, tamper with deployment configurations, or exfiltrate secrets stored in pipeline environment variables.

Security misconfigurations in Infrastructure as Code templates (Terraform, CloudFormation, Kubernetes manifests) deploy resources with overly permissive access, missing encryption, or exposed management interfaces.

Kubernetes clusters deployed with insecure defaults, overly permissive RBAC policies, missing network segmentation, or exposed dashboards enable container escape, lateral movement, and cluster compromise.

Cloud storage buckets (S3, GCS, Azure Blob) misconfigured with public access or overly permissive policies expose sensitive data, credentials, and internal artifacts to unauthorized access.

Overly permissive cloud IAM policies, misconfigured role assumptions, or excessive service account permissions enable attackers to escalate privileges and gain unauthorized access to cloud resources.

Cloud environments with secrets stored in plaintext environment variables, hardcoded in code, or managed without proper rotation and access controls expose credentials to unauthorized access and exfiltration.

IoT device management panels and embedded web interfaces ship with default credentials, lack authentication, or contain XSS and command injection flaws that allow attackers to take full control of devices and pivot into internal networks.

IoT devices with firmware update mechanisms that lack code signing verification, use unencrypted transport, or accept unsigned images allow attackers to install malicious firmware, creating persistent backdoors across device fleets.

IoT devices expose insecure network services such as Telnet, unauthenticated MQTT, open SNMP, or unencrypted CoAP, enabling eavesdropping, unauthorized device control, and use as pivot points for network attacks.

Attackers escape the kiosk application sandbox to access the underlying operating system through input field exploits, keyboard shortcut injection, or peripheral manipulation, gaining full control of the kiosk device.

Kiosk applications fail to clear session data, cached credentials, form inputs, or browsing history between user sessions, exposing the previous user's sensitive information to the next user.

CI/CD pipelines expose secrets through plaintext environment variables, verbose build logs, misconfigured artifact storage, or overly broad secret access, enabling attackers to harvest production credentials and cloud API keys.

Attackers exploit misconfigured containers, kernel vulnerabilities, or privileged container settings to break out of container isolation and gain access to the host operating system, other containers, or the underlying infrastructure.

Serverless functions (AWS Lambda, Azure Functions, Google Cloud Functions) process untrusted input without proper validation, enabling injection attacks, unauthorized data access, and abuse of excessive function permissions to compromise cloud resources.

Discrepancies in how front-end proxies and back-end servers parse HTTP requests allow attackers to smuggle a hidden request inside another, enabling cache poisoning, session hijacking, WAF bypass, and access to other users' responses.

GraphQL endpoints with introspection enabled, missing query complexity limits, or inadequate authorization checks allow attackers to enumerate the full schema, execute deeply nested queries causing denial of service, or access unauthorized data through field-level authorization bypass.

WebSocket connections lacking proper origin validation, authentication, or encryption allow attackers to hijack active connections, inject malicious messages, intercept sensitive data, or perform cross-site WebSocket hijacking from malicious pages.

An API accepts a user-controlled object identifier but does not verify that the authenticated caller is authorized to access that specific object, enabling cross-account data access or modification.

An API exposes or accepts object properties that the caller should not be able to read or modify, combining excessive data exposure and mass-assignment risks.

An API lacks enforceable limits on requests or downstream work, allowing attackers to exhaust CPU, memory, storage, bandwidth, paid services, or operational budgets.

An API exposes a legitimate business operation without sufficient anti-automation controls, allowing abuse such as bulk purchasing, fake account creation, spam, scraping, or reservation hoarding.

Undocumented, deprecated, test, or shadow API deployments remain reachable without current security controls, exposing forgotten data paths and vulnerable versions.

An application trusts data, redirects, files, or behavior from an integrated API without applying the same validation and isolation used for direct user input.

An attacker compromises or impersonates an executive, vendor, or employee mailbox to trick staff into wiring funds, changing payment details, or sending sensitive data.

An attacker with stolen credentials floods a user with MFA push prompts, or poses as IT support, until the user approves one and grants access.

Users are tricked into granting a malicious third-party OAuth application access to their mail, files, or profile, giving the attacker persistent API access that survives password resets.

An attacker forges or tampers with JSON Web Tokens by exploiting weak signing secrets, the none algorithm, or confusion between asymmetric and symmetric algorithms, gaining arbitrary identities or roles.

An attacker publishes a public package with the same name as an internal one, and build tools install the attacker's higher-versioned package instead, running malicious install scripts in CI or developer machines.

Attackers use leaked cloud credentials or exposed workloads to launch large compute instances or containers that mine cryptocurrency, generating heavy bills and often signaling broader account compromise.

An attacker gains control of a domain's DNS records through a compromised registrar or DNS provider account, redirecting users and email to attacker infrastructure and enabling credential theft and fraudulent certificates.

Internet-exposed IoT devices with default credentials or unpatched vulnerabilities are compromised at scale and enrolled into botnets used for DDoS attacks, proxying, and further scanning.

An attacker connects a malicious USB device, such as a keystroke injector or rogue network adapter, to an unattended kiosk to execute commands, escape the kiosk shell, or capture traffic.

An API binds client-supplied fields directly to internal objects, letting attackers set properties they should not control, such as role, isAdmin, balance, or ownerId.

Attackers inject malicious JavaScript into checkout or login pages, often through a compromised third-party script, tag manager, or plugin, and silently send card data or credentials to a domain they control.

Infostealer malware on an employee or customer device exports browser cookies, saved passwords, and tokens, letting attackers replay authenticated sessions and skip MFA entirely.

Attackers try a few common passwords against many accounts, staying under per-account lockout thresholds, to find any account with a weak or reused password.

A database or search cluster such as MongoDB, Elasticsearch, Redis, or PostgreSQL is reachable from the internet without authentication or with default credentials, and its contents are copied, wiped, or held for ransom.

Attackers exploit vulnerabilities in internet-facing VPN gateways, firewalls, or remote access appliances, often within days of disclosure, to gain a foothold that bypasses most endpoint controls.

Passwords, tokens, card numbers, or personal data are written to application logs and then copied into log platforms, tickets, and backups that many more people can read.