Practice

Remote Code Execution — running attacker-chosen code on the target. Unauthenticated RCE is CRITICAL.

Cross-Site Scripting — injecting script into pages others view. Stored XSS firing for all users is HIGH.

SQL Injection — manipulating a database query via unescaped input. Check every sql.raw() and dynamic identifier.

Server-Side Request Forgery — making the server fetch an attacker-controlled URL. Watch redirects, DNS rebinding, webhooks.

Insecure Direct Object Reference — accessing another user's object by changing an ID, with no authorization check.

Cross-Site Request Forgery — tricking a logged-in user's browser into a state-changing request. MEDIUM when it has real effect.

Time-Of-Check to Time-Of-Use — a gap between checking and using lets state change in between. The classic check-then-act bug.

Escaping the intended directory via ../, symlinks, encoded sequences or null bytes to read/write arbitrary files.

Archive extraction writing entries outside the target directory because paths aren't constrained.

Data safe when stored becomes dangerous when later used in a different context — a SQL-safe value used as a JSON-path key.

A redirect parameter (redirect/return/next/url) sent somewhere unvalidated — a building block for token theft and phishing.

Layered controls. If Layer A already blocks the attack, the absence of Layer B is a hardening note, not a vulnerability.

Where untrusted input crosses into a trusted context. Bugs cluster where one component implicitly trusts another.

Comparable mainstream software used to calibrate findings. Exploited there → stronger finding; never exploited → understand why.

Two components parse the same input differently — the router and the app disagree on a URL, opening a bypass.

A reported "vulnerability" that isn't real. Phase 3's whole job is to kill these adversarially.