Appsec Glossary

Browse 28 appsec terms defined in plain English, from the cultural dictionary of computing.

28 Appsec Terms

Application Security
Application Security is the practice of designing, building, testing, and operating software in ways that reduce exploitable weakness. Security teams use it to...
Black Box Testing
Black Box Testing is a security testing approach that evaluates a target without internal design knowledge, using only external behavior and exposed...
Burp Suite
Burp Suite is an application security testing platform for intercepting traffic, manipulating requests, and auditing web behavior. Security teams use it to...
Business Logic Vulnerability
Business Logic Vulnerability is a flaw in intended workflow rules that lets a user violate business constraints without exploiting a low-level parser bug....
CAPTCHA Bypass
CAPTCHA Bypass is an attack technique in which an adversary evades human-verification controls with automation, relays, or weaknesses in challenge design....
Code Injection
Code Injection is the introduction of attacker-controlled code or executable instructions into an application or processing context. Security teams use it to...
Cookie Poisoning
Cookie Poisoning is an attack technique in which an adversary modifies cookie contents to tamper with state, privileges, or application logic. Defenders...
Dynamic Application Security Testing
Dynamic Application Security Testing is runtime testing of a running application by sending requests and observing behavior from the outside. Security teams...
Fuzz Testing
Fuzz Testing is automated testing that feeds malformed or unexpected input to software to expose crashes and logic flaws. Security teams use it to enforce...
Gray Box Testing
Gray Box Testing is security testing performed with partial knowledge of the target such as architecture, credentials, or API documentation. Security teams use...
Host Header Injection
Host Header Injection is an attack technique in which an adversary supplies a malicious Host header that changes routing, links, or security logic. Defenders...
HTTP Parameter Pollution
HTTP Parameter Pollution is an attack technique in which an adversary adds duplicated or conflicting parameters so the server parses input unexpectedly....
HTTP Request Smuggling
HTTP Request Smuggling is an attack technique in which an adversary desynchronizes front-end and back-end HTTP parsing to hide or splice requests. Defenders...
HTTP Response Splitting
HTTP Response Splitting is an attack technique in which an adversary injects header delimiters so one response becomes multiple attacker-influenced responses....
HTTPS Stripping
HTTPS Stripping is an attack technique in which an adversary forces a victim onto HTTP by interfering with secure upgrade or redirect behavior. Defenders...
Information Disclosure
Information Disclosure is the exposure of sensitive information to parties that were not meant to receive it. Security teams use it to enforce trust, reduce...
Input Validation
Input Validation is the checking and normalization of untrusted input before it reaches logic, storage, or execution contexts. Security teams use it to enforce...
Mobile App Security
The protection of mobile applications against reverse engineering, insecure storage, weak authentication, API abuse, malicious tampering, and unsafe platform...
NAXSI
NAXSI is a web application firewall for NGINX that uses rule-based detection to block common web attacks. Security teams use it to enforce trust, reduce...
Open Redirect
Open Redirect is an attack technique in which an adversary abuses redirect logic so a trusted site sends users to an attacker-controlled destination. Defenders...
OWASP Top 10
A widely used awareness document summarizing the most critical web application security risks identified by OWASP. It shows up in application security,...
RASP
Runtime Application Self-Protection, a defense that monitors and blocks attacks from inside the running application. It shows up in application security,...
SAST Tool
A static application security testing tool that analyzes source code or binaries without executing them. It shows up in application security, identity,...
SQL Injection Attack
An injection flaw where attacker-controlled input alters SQL queries to read, modify, or destroy database data. It shows up in application security, identity,...
Static Application Security Testing
A code analysis approach that finds security flaws in source or bytecode before the application runs. It shows up in application security, identity,...
Web Application Firewall Rule
A specific web application firewall rule that matches suspicious request patterns and applies protective actions. It shows up in application security,...
XML External Entity
An XML parser feature that can fetch external resources and becomes dangerous when untrusted input is processed. It shows up in application security, identity,...
XXE Attack
An attack that abuses XML external entity resolution to read files, pivot requests, or cause denial of service. It shows up in application security, identity,...

Related Topics