Most web application compromises still come from a small set of well-documented attack classes, where untrusted input reaches an interpreter, a parser, a URL fetcher or an access decision that trusts it. OWASP reports that every application tested for the Top 10:2025 had some form of broken access control, and CISA and the FBI note that SQL injection keeps shipping although effective mitigations have been known for about two decades. This guide is a defensive reference: it describes each major class at the level of MITRE CAPEC and OWASP, gives CAPEC, CWE and OWASP identifiers so findings are triaged consistently, and spends most of its length on prevention, detection and testing. It is for application security engineers, developers, architects and SOC teams who own internet-facing web applications and APIs, and it contains no payloads or exploitation steps.
Key takeaways
- Separate data from code at the library level. Parameterised queries, safe process APIs, auto-escaping templates and data-only serialisation formats remove whole classes instead of single bugs.
- Use the taxonomies together. CAPEC names the attack pattern, CWE the weakness, the OWASP Top 10:2025 the reporting category, and MITRE ATT&CK records successful exploitation as T1190 Exploit Public-Facing Application.
- Treat SSRF and access control as identity problems. SSRF reaches cloud role credentials, IDOR is a missing authorisation check, and session theft bypasses authentication entirely.
- A WAF buys time, not correctness. It blocks commodity scanning and allows virtual patching, but cannot see business logic, second-order input or authorisation flaws.
- Test against a standard. OWASP ASVS 5.0.0 sets requirements and the Web Security Testing Guide supplies test cases with stable IDs, so results compare across teams and suppliers.
How web application attacks are classified
| System | What it describes | Example | Use it for |
|---|---|---|---|
| MITRE CAPEC 3.9 | Attack patterns | CAPEC-66 SQL Injection, child of CAPEC-248 Command Injection | Threat modelling and test planning |
| MITRE CWE | Weaknesses in code or design | CWE-89 SQL Injection | Root-cause tagging of SAST, DAST and pen test findings |
| OWASP Top 10:2025 | Risk categories mapped to CWEs | A05:2025 Injection (37 CWEs) | Reporting, policy and supplier requirements |
| MITRE ATT&CK v20 | Adversary behaviour after exploitation | T1190 (Initial Access) | Detection engineering and incident reporting |
The current OWASP edition is the Top 10:2025. Two changes matter for mapping: SSRF (CWE-918), a standalone category in 2021, now sits in A01:2025 Broken Access Control, and cross-site scripting stays in A05:2025 Injection, where OWASP counts more than 30,000 CVEs for XSS and more than 14,000 for SQL injection. In the tables below the OWASP column gives the 2025 category with 2021 in brackets; "not confirmed" means the CWE is not in that 2025 category's published mapping.
Injection attacks
CAPEC-248 describes an adversary who "injects new items into an existing command", changing how a downstream interpreter reads it. OWASP's A05:2025 guidance is the defensive form: "keeping data separate from commands and queries". Escaping is a fallback that OWASP calls error-prone, and stored procedures that concatenate input in PL/SQL or T-SQL remain injectable.
| Attack class | CAPEC | CWE | OWASP | Targets | Primary defences |
|---|---|---|---|---|---|
| SQL injection (blind, ORM, SOAP variants) | 66; 7, 108, 109, 110 | 89 | A05:2025 (A03:2021) | Relational queries | Prepared statements, allowlisted sort and column names, least-privilege database accounts |
| NoSQL injection | 676 | 943 | Not confirmed | Document store operators | Typed query builders, reject operator objects, no server-side JavaScript |
| OS command injection | 88; 15 | 78 | A05:2025 (A03:2021) | Shell and system calls | Library APIs instead of shells, argument arrays, allowlisted values |
| LDAP injection | 136 | 90 | A05:2025 (A03:2021) | Directory searches | Filter encoding, query builders, read-only bind accounts |
| XPath and XQuery injection | 83, 84 | 643, 652 | A05:2025 (CWE-643) | XML data queries | Precompiled, parameterised expressions |
| Server-side template injection | Parent 242 Code Injection | 1336 | Not confirmed | Template engines | Never build templates from input; logic-less or sandboxed engines |
| Expression language injection (Log4Shell class) | Parent 242 | 917 | A05:2025 | Libraries that evaluate lookups | Patch, disable lookups, egress filtering |
| Server Side Include injection | 101 | 97 | Not confirmed | Servers with SSI enabled | Disable SSI or its exec directive |
| IMAP/SMTP command injection | 183 | 77 (parent) | Not confirmed | Webmail and mail features | Mail library APIs, reject CR and LF in headers |
| HTTP response splitting | 34 | 113 | A05:2025 | Headers built from input | Framework header APIs that reject CR and LF |
| Log injection, tampering and forging | 93 | 117 | Not confirmed | Audit trails, log viewers | Structured logging, encoded line breaks |
Log4Shell (CVE-2021-44228) is the reference expression injection case: a logging library evaluated lookups inside logged strings, so any logged field became an injection point. Automated SQL injection tools such as sqlmap and Havij drive much opportunistic scanning, and their request patterns are well covered by WAF rule sets, which is why WAF logs often show the first probe.
Cross-site scripting and browser-side attacks
CAPEC-63 defines XSS as an adversary who "embeds malicious scripts in content that will be served to web browsers". The variants differ in where the script is stored and assembled, which decides where the fix belongs.
| Attack class | CAPEC | CWE | OWASP | Targets | Primary defences |
|---|---|---|---|---|---|
| Reflected XSS | 591 | 79 | A05:2025 (A03:2021) | Responses echoing request data | Contextual output encoding, auto-escaping templates |
| Stored XSS | 592 | 79 | A05:2025 (A03:2021) | Saved content shown to others, including admins | Encoding at render time, HTML sanitisation for rich text |
| DOM-based XSS | 588 | 79 | A05:2025 (A03:2021) | Client-side code writing to dangerous sinks | Safe DOM APIs, Trusted Types, sanitiser for HTML sinks |
| Cross-site request forgery | 62 | 352, 1275 | A01:2025 (A01:2021) | State changes carried by ambient cookies | Synchroniser or signed double-submit tokens, SameSite cookies, re-authentication |
| Clickjacking, iFrame overlay | 103, 222 | 1021 | Not confirmed | Framed pages | CSP frame-ancestors, X-Frame-Options |
| Open redirect | None verified | 601 | A01:2025 (A01:2021) | Redirect parameters, OAuth redirect URIs | Allowlisted destinations, exact redirect URI matching |
| Cross Site Tracing | 107 | Not confirmed | Not confirmed | HTTP TRACE | Disable TRACE |
| JSON hijacking | 111 | Not confirmed | Not confirmed | JSON read cross-origin by old browsers | Correct content type, tokens on data endpoints |
| Missing origin validation in WebSockets | None verified | 1385 | Not confirmed | Cookie-authenticated handshakes | Check Origin, per-connection tokens |
Many CAPEC XSS entries are filter evasions: non-script elements (18), scripts within scripts (19), HTTP headers (86), error pages (198), alternate syntax (199), MIME type mismatch (209), HTML attributes (243), URI placeholders (244), doubled characters (245) and invalid characters (247). Their shared lesson is CWE-692, Incomplete Denylist to Cross-Site Scripting: filters that hunt for bad strings lose to encoding tricks, while encoding for the exact output context (HTML body, attribute, URL, JavaScript, CSS) does not depend on recognising the attack. DOM clobbering, where injected elements with id or name attributes override JavaScript globals, is handled by sanitiser configuration and by not relying on implicit globals. Flash-era patterns (178, 174, 181) matter only where legacy SWF files remain on old hosts; Adobe ended Flash support at the end of 2020.
Server-side request, file and parser attacks
| Attack class | CAPEC | CWE | OWASP | Targets | Primary defences |
|---|---|---|---|---|---|
| SSRF, including blind SSRF | 664 | 918 | A01:2025 (A10:2021) | Internal services, instance metadata | Destination allowlist, server-built requests, no redirects, egress firewall, IMDSv2 |
| Path or directory traversal | 126; 139, 597, 76 | 22 | A01:2025 (A01:2021) | Files outside the intended directory | Indirect file references, canonicalise then check base directory, least privilege |
| Local and remote file inclusion | 252, 193; 253 | 98 | Not confirmed | Include statements fed by input | Fixed include maps, PHP allow_url_include off |
| Unrestricted file upload | 23 File Content Injection | 434, 616 | Not confirmed | Upload handlers and served storage | Content-based type allowlist, random names, storage outside the web root or on a separate domain, scanning |
| XML external entity (XXE) | 221; 201, 228 | 611 | A02:2025 (A05:2021) | XML parsers | Disable DTDs and external entity resolution |
| Entity expansion, oversized payloads | 197, 229, 230, 231, 147 | 776 | A02:2025 | Parser memory and CPU | Depth, size and expansion limits |
| Insecure deserialisation | 586 Object Injection | 502 | A08:2025 (A08:2021) | Native deserialisers, gadget chains | Data-only formats, type allowlists, signed payloads, server-side session state |
- SSRF: CAPEC files CAPEC-664 under CAPEC-115 Authentication Bypass, a useful reminder that the server's network position and credentials stand in for the attacker's. The OWASP SSRF Prevention Cheat Sheet says, where destinations are known, "Match the host against an allowlist, and build the request yourself"; for webhooks and other arbitrary destinations a blocklist is a weaker fallback, since "Deny-lists are bypass-prone". "Domain allowlisting alone does not prevent DNS rebinding", so validate and connect to the resolved address, disable redirects, and on AWS migrate to IMDSv2. Blind SSRF is found through out-of-band testing and egress logs.
- Encoding tricks: CAPEC-267 Leverage Alternate Encoding covers double encoding (120), URL and Unicode encoding (72, 71), NULL bytes (52), slashes in alternate encoding (78, 79), alternative IP encodings (4) and multiple interpretation layers (43). Canonicalise once, then validate; the reverse order is CWE-180.
- Deserialisation: OWASP A08:2025 says not to accept unsigned serialised data from untrusted clients without an integrity check that detects tampering or replay. Signing keys then become critical secrets: the ToolShell SharePoint exploitation showed stolen ASP.NET machine keys keeping attackers in after patching.
HTTP protocol, caching and access control attacks
- HTTP request smuggling (CAPEC-33, CWE-444): front end and back end disagree about where a request ends. CAPEC lists it, with request splitting (105) and response smuggling (273), as a precursor to XSS. Use HTTP/2 end to end where possible and have the edge reject ambiguous framing.
- Web cache poisoning and deception (CAPEC-141): poisoning stores a harmful response under a shared key; deception gets a victim's personalised page cached under a static-looking path. Key on every input that changes the response, mark personalised responses no-store or private, and decide cacheability from headers, not file extensions.
- HTTP verb tampering (CAPEC-274) and web server misclassification (CAPEC-11): rules written for GET and POST or for file extensions miss other methods and handlers. Authorise every method in the application.
- IDOR (CWE-639), forceful browsing (CAPEC-87) and hidden field manipulation (CAPEC-162): the server trusts an identifier, URL or client value, the same mistake as CWE-472 External Control of Assumed-Immutable Web Parameter. Check ownership on every request; the McHire flaw paired a default password with an IDOR across applicant records.
- Directory indexing (CAPEC-127) and non-production interfaces (CAPEC-121): disable listings and remove debug and staging endpoints from production.
Where identity fits
- SSRF to workload credentials: the Capital One breach is the reference case. Enforce IMDSv2, scope instance roles tightly and alert on role use from outside the workload. See the Cloud Workload Identity Guide.
- Session hijacking (CAPEC-593), fixation (CAPEC-61) and sidejacking (CAPEC-102): regenerate session IDs at login (CWE-384), set Secure, HttpOnly and SameSite, and invalidate server-side sessions at logout as A01:2025 advises. CitrixBleed showed stolen session tokens bypassing MFA. See the Token and Session Security Guide.
- Credential stuffing (CAPEC-600): the 23andMe breach began with reused passwords. Rate limit, check breached passwords and require phishing-resistant MFA. See the Account Takeover Prevention Guide and the Bot Management Guide.
- OAuth misconfiguration: open redirects and loose redirect URI matching leak codes and tokens. Require exact matching, PKCE and state. See the OAuth 2.0 and OpenID Connect Guide.
- Machine credentials behind the application: database, bind and API accounts set the blast radius. The McKinsey Lilli incident involved SQL injection in unauthenticated APIs, and the Smithery.ai breach turned a path traversal into a platform token. See the Secrets Management Guide.
Defences and the limits of a WAF
| Control | Stops or reduces | Does not stop |
|---|---|---|
| Parameterised data access layer | SQL, NoSQL, LDAP, XPath injection | Dynamic identifiers, concatenating stored procedures |
| Auto-escaping templates | Reflected and stored XSS | DOM XSS, unsafe raw helpers |
| Strict CSP (nonces or hashes, frame-ancestors) | Impact of most XSS, clickjacking | Policies allowing unsafe-inline |
| SameSite cookies plus CSRF tokens | Cross-site request forgery | Attacks from compromised subdomains, XSS-driven requests |
| Egress allowlist from the web tier | SSRF impact, out-of-band callbacks | SSRF to allowed internal services |
| Hardened parser configuration | XXE, entity expansion, deserialisation gadgets | Logic flaws in parsed data |
| Central authorisation with ownership checks | IDOR, forceful browsing, verb tampering | Flaws in the policy itself |
| WAF and virtual patching | Scanners, known CVE exploits, obvious injection | Business logic, IDOR, second-order injection, authenticated abuse |
| RASP | Injection reaching a monitored sink, few false positives | Access control and logic flaws; adds overhead |
Positive input validation (type, length, range, format) at the trust boundary still helps, but OWASP says it is not a complete defence for injection. Standardise cookies as Secure, HttpOnly and SameSite=Lax (Strict for admin sessions), with the __Host- prefix for session cookies, and send Strict-Transport-Security and X-Content-Type-Options: nosniff.
Implementation roadmap
- Inventory exposure: list internet-facing applications and APIs with owners, frameworks and data sensitivity. See the Attack Surface Management Guide.
- Baseline: run DAST and WSTG tests, tag findings with CWE and CAPEC, and rank by class.
- Fix by class in shared code: data access layer, template defaults, an HTTP client with SSRF controls, safe XML and serialisation factories, central authorisation middleware.
- WAF in detection mode first: log-only for two to four weeks, tune per-rule exclusions, then block high-confidence rules. Roll back per rule or by returning the policy to detection.
- CSP report-only: collect Content-Security-Policy-Report-Only violations, remove inline script, then enforce. Roll back by reverting the header.
- Cookie and CSRF pilot: change one application first and watch cross-site flows such as payment returns and SSO callbacks.
- Web tier egress: log outbound connections, build the allowlist from observed flows, then default-deny.
- Gate the pipeline: SAST and dependency scanning on merge, DAST before release, ASVS acceptance criteria. See the Vulnerability Management Guide.
Detection, testing and decision guidance
What to monitor
- WAF events: rule ID, action, matched field, client IP and user, sent to the SIEM. See the SIEM Guide.
- Application errors: database syntax, template, deserialisation and XML parser exceptions, and 4xx or 5xx spikes per route.
- Web tier behaviour: shells spawned by web server processes and outbound connections to 169.254.169.254 or unknown hosts. ATT&CK's T1190 detection strategy (DET0080) correlates request, error and process or egress signals.
- CSP violation reports and access control failures: OWASP A01:2025 advises alerting on repeated failures, which is how IDOR enumeration appears.
Test cases (OWASP WSTG v4.2)
| WSTG ID | Test |
|---|---|
| WSTG-INPV-01, 02 | Reflected and stored XSS |
| WSTG-INPV-03 | HTTP verb tampering |
| WSTG-INPV-05 | SQL injection, with NoSQL and ORM subsections |
| WSTG-INPV-06, 07, 08, 09 | LDAP, XML, SSI and XPath injection |
| WSTG-INPV-11, 12 | Code injection with file inclusion; command injection |
| WSTG-INPV-15, 17 | HTTP splitting and smuggling; host header injection |
| WSTG-INPV-18, 19 | Server-side template injection; SSRF |
| WSTG-ATHZ-04, WSTG-SESS-05 | IDOR; cross-site request forgery |
Set acceptance criteria from ASVS 5.0.0, whose "Encoding and Sanitization" chapter holds the injection prevention requirements: Level 1 for most public applications, Level 2 for sensitive data, Level 3 for high-assurance systems.
Choosing between options
- Code fix, WAF or RASP: fix code you own; use WAF virtual patching for third-party or legacy applications until a vendor fix lands; consider RASP for legacy Java or .NET applications that cannot be rewritten.
- SSRF allowlist or blocklist: allowlist when destinations are known; webhooks and URL previews need a blocklist plus network egress controls and an isolated fetch service.
- Small versus large organisations: small teams lean on framework defaults, a managed WAF or CDN rule set and an annual WSTG test; large ones publish secure framework wrappers, set ASVS levels by data class and track findings by CWE across the portfolio.
Metrics
- Open critical and high web findings by CWE, and median time to remediate.
- Share of applications on the approved data access layer and auto-escaping templates.
- Share of internet-facing applications with enforced CSP and a blocking WAF.
- Share of web-tier workloads with default-deny egress and IMDSv2 enforced.
- Repeat findings: the same CWE recurring in the same application within 12 months.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | CIS Controls v8.1 | ISO/IEC 27001:2022 | ATT&CK v20 |
|---|---|---|---|---|
| Secure coding and input handling | SI-10; SA-15 | 16.1, 16.12 | A.8.25, A.8.28 | T1190; M1050 Exploit Protection |
| Security testing | SA-11; RA-5 | 16.13 | A.8.29 | M1016 Vulnerability Scanning |
| WAF, egress, segmentation | SC-7 | 13.10 | A.8.20, A.8.22 | M1037 Filter Network Traffic; M1030 Network Segmentation |
| Access control and sessions | AC-3; SC-23 | Control 6 | A.8.3, A.8.5 | M1026 Privileged Account Management |
| Runtime protection and monitoring | SI-7(17) Runtime Application Self-Protection; SI-4 | Control 8 | A.8.16 | M1048 Application Isolation and Sandboxing |
Other CAPEC patterns tracked
Listed by ID for completeness; see the CAPEC entries for descriptions: CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads · CAPEC-85 AJAX Footprinting · CAPEC-104 Cross Zone Scripting · CAPEC-146 XML Schema Poisoning · CAPEC-173 Action Spoofing · CAPEC-219 XML Routing Detour Attacks · CAPEC-278 Web Services Protocol Manipulation · CAPEC-468 Generic Cross-Browser Cross-Domain Theft · CAPEC-587 Cross Frame Scripting (XFS). Related weakness entries: CWE-85 Doubled Character XSS Manipulations · CWE-626 Null Byte Interaction Error · CWE-790 Improper Filtering of Special Elements · CWE-791 Incomplete Filtering of Special Elements.
Common failure patterns
- Escaping instead of parameterising: hand-written escaping and denylists fail against alternate encodings; CISA and the FBI point to a managed file transfer SQL injection campaign that affected thousands of organisations.
- Closing findings because the WAF blocks the test string: the flaw stays reachable through another encoding or an authenticated API the WAF does not inspect.
- Open outbound access from the web tier: SSRF and Log4Shell-style callbacks succeed because servers reach the metadata service and the internet, as in the Capital One breach.
- Authorisation only in the user interface: hidden buttons do not stop direct API calls, so IDOR follows.
- Patching without rotating: after deserialisation or file-read flaws, signing keys and service credentials the attacker could read stay valid unless rotated.
- Over-privileged application accounts: a database or directory account that can read everything turns one injection into total data loss. See the Service Account Security Guide.
Practitioner checklist
- Require parameterised queries through a shared data access layer and flag raw query construction in SAST and review.
- Use auto-escaping templates, safe DOM APIs and Trusted Types; enforce a nonce- or hash-based CSP after report-only.
- Set session cookies Secure, HttpOnly, SameSite and __Host-, regenerate IDs at login, and add CSRF tokens to state changes.
- Route server-side URL fetching through one hardened client with an allowlist, no redirects and resolved-address checks; enforce IMDSv2.
- Disable DTDs and external entities in every XML parser and stop deserialising native objects from untrusted input.
- Enforce object-level authorisation centrally and log every access control failure.
- Tune the WAF in detection mode before blocking, and never close a code finding because the WAF blocks it.
- Default-deny web tier egress and alert on shells spawned by web server processes.
- Test against WSTG IDs and accept releases against an ASVS 5.0.0 level chosen by data sensitivity.
- Rotate keys and credentials the application can read after any injection, traversal or deserialisation incident.
Standards and references
- OWASP: Top 10:2025
- MITRE: CAPEC Mechanisms of Attack (CAPEC-1000)
- MITRE ATT&CK: T1190 Exploit Public-Facing Application
- OWASP: Application Security Verification Standard
- OWASP: Web Security Testing Guide
- OWASP: Server Side Request Forgery Prevention Cheat Sheet
- CISA and FBI: Secure by Design Alert, Eliminating SQL Injection Vulnerabilities in Software
Related NHI Mgmt Group resources: Token and Session Security Guide · OAuth 2.0 and OpenID Connect Guide · Account Takeover Prevention Guide · Secrets Management Guide · Vulnerability Management Guide