Attack Classes
Phase 2 splits the hunt across these scopes. Not every class applies to every codebase — choose based on Recon. Tap a card for what each one chases.
9 class(es)
Standard classes4
InjectionTrace untrusted input from entry point to a dangerous sink.
What counts as a dangerous sink depends on the app: SQL/HTML/shell/templates/file paths for web apps; buffers and parsers for libraries; command construction for CLI tools. Don't just check direct paths — look for indirect (second-order) injection where data is stored safely then used dangerously later, and injection through field names, keys, headers and metadata, not just values.
What to chase
- Indirect / second-order injection (store safe, use dangerous later).
- Injection into secondary systems: logs, caches, search indexes, analytics.
Access controlCan a caller do something they shouldn't? Check the right permission, on the right resource, via the right mechanism.
Go beyond "does a permission check exist". Is there a weaker-checked path to the same state change? Can a request-body field override what the permission system intended? Are there endpoints that gate on authentication but forget authorization? Do bulk/batch/export/import operations enforce per-item permissions?
What to chase
- Multiple access paths to one resource with inconsistent checks.
- Authenticated-but-not-authorized endpoints.
Resource & file handlingPath traversal, SSRF, unsafe deserialization, archive extraction, memory safety, and file-op races.
Path traversal through symlinks, encoded sequences and null bytes. SSRF through redirects, DNS rebinding, and URL-parser differentials. Zip slip on archive extraction. Memory safety (buffer overflow, use-after-free, integer overflow) where applicable. TOCTOU races between checking a file and using it.
What to chase
- URL validation that breaks after a redirect.
- Archive entries that escape the target directory.
Cryptography & secretsWeak randomness, hardcoded secrets, broken KDF/HMAC, timing side-channels, primitive misuse.
Weak randomness for tokens/keys/nonces. Secrets in logs, errors, URLs or client-visible responses. Missing HMAC verification, nonce reuse, ECB mode, static IVs. And the failure path: when a crypto operation fails, does the error path fall back to no-crypto?
What to chase
- Secret comparison that isn't constant-time.
- Crypto failure falling back to plaintext.
Where the real bugs hide3
Business logicWhere the real bugs hide — scanners can't find logic errors.
State-machine violations: skip steps, go backwards, replay a completed flow; if step 2 of 3 fails, is step 1 rolled back? Race conditions with business impact (double-spend, double-approve). Numeric manipulation: negatives, zero, overflow, precision, string↔number coercion. Time-based logic at exact boundary moments. Security posture when config is missing or a flag is off.
What to chase
- Check-then-act done non-atomically.
- Partial-failure leaving half-modified state.
Feature abuse & data leakageLegitimate features used for unintended purposes — bugs in the design, not the code.
Export/backup as exfiltration — can a low-privilege user export data above their level, or deleted/draft content? Import/restore as injection — can it create records that bypass validation? Search/filter/sort as an oracle — does it reveal whether content exists that you can't access? Enumeration through differing errors/timings. Preview/draft leakage. Notification/webhook URLs as SSRF.
What to chase
- Export includes other users' or pruned/deleted data.
- Filter parameters probe hidden statuses or fields.
Chained attacks & trust boundariesIndividually-safe behaviors that become dangerous in combination.
Multi-step chains: info disclosure + IDOR + missing rate limit = brute-force; open redirect + OAuth callback = token theft. Cross-component trust gaps where B trusts A's subtly-different validation. Second-order: a value safe in SQL becomes a key in a JSON path; a slug safe in a URL becomes part of a file path. Scope/capability escalation. Rollback/recovery abuse where undelete or restore bypasses current permissions.
What to chase
- A validates 255 chars, B truncates at 128 → different string.
- Restore brings back more than intended, bypassing today's rules.
Open-ended2
WildcardNo category. You're given the codebase and told to break it.
Find the thing nobody thought to look for. Read the boring code. What's the strangest code, and what if it's abused? What features feel half-finished or bolted on (weakest review)? What API calls are possible but the frontend never makes? Anything interesting in git history — reverted security fixes, commented-out auth, committed-then-removed secrets? If a variable is named temp, hack, or legacy, read every line.
What to chase
- Mix features never meant to combine: i18n + preview + caching.
- Maximum damage with a valid account — sabotage, not escalation.
Obvious thingsThe dumb stuff everyone assumes someone else already checked.
Be thorough and literal, not creative. Hardcoded passwords/keys/tokens. Security TODO/FIXME/HACK comments. Debug mode reachable in production. Unprotected /debug, /admin, /metrics, /.env. Committed .env or *.pem files. CORS set to * with credentials. Cookies missing HttpOnly/Secure/SameSite. Open redirects. eval()/exec() with dynamic input. But trace the impact before reporting — a flag is not a finding.
What to chase
- A missing HttpOnly only matters if JS needn't read the cookie.
- An error message field only matters if it's ever populated with secrets.