OWASP PNW 2024 - 2

Ant-Man and OWASP Top Ten

200

Concatenate input into your DB queries and you'll be vulnerable to this.

SQL Injection

400

../../../../../../home/sandersc/recipe.txt

Directory Traversal

600

Make this server touch that server by giving a URL as input.

SSRF

800

This type of XSS attack doesn't even need to touch the server.

DOM-based XSS

1000

It can be broken horizontally or vertically.

Authorization (Access Control)

Decoded Using...

200

aHR0cHM6Ly8=

Base64

400

%6c%65%6d%6f%6e

URL

600

party

HTML Entities

800

FZRW63JPEBUXGIDBEA======

Base32

1000

CIA=20Honeypot=21

Quoted-Printable

LTTRS

200

CSRF

Cross-site Request Forgery

400

CSTI

Client Side Template Injection

600

STRIDE

Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege

800

SHA

Secure Hash Algorithms

1000

ASCII

American Standard Code for Information Interchange

You Wouldn't Download A Bar

200

1 1/2 oz - Silver tequila
1 oz - Triple Sec
3/4 oz - Freshly-squeezed lime juice

Margarita

400

1 1/2 oz - Bourbon or Rye
1 cube - Sugar
2 dashes - Angostura bitters

Old Fashioned

600

2 1/2 oz - Gin
3/4 oz - Simple syrup
3/4 oz - Lime juice

Gimlet

800

1 1/2 oz - Gin
3/4 oz - freshly squeezed lemon juice
3/4 oz -  Simple syrup
Club soda to top off 

Tom Collins

1000

3/4 oz - Bourbon
3/4 oz - Aperol
3/4oz - Amaro Nonino
3/4 oz - Lemon juice

Paper Plane

RCE Languishes

200

<?=`$_GET[0]`?>

PHP

400

os.system(request.args.get('cmd'))

Python (Flask)

600

EXEC xp_cmdshell '<cmd>';

MS SQL Server

800

Process.Start(Request.QueryString["cmd"]);

ASP.NET

1000

COPY (SELECT '') TO PROGRAM '<cmd>';

Postgres