new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

attack-surface/mapping

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Dynamic scanning tools for Attack Surface discovery

For web applications, use tools to crawl and map accessible attack surface including: ZAP, Arachni, Skipfish, w3af, or commercial dynamic testing and vulnerability scanning tools. Some web application firewalls (WAFs) may also export a model of the application's entry points.

Entry and exit point categories for Attack Surface mapping

Attack Surface entry and exit points include: User interface forms and fields, HTTP headers and cookies, APIs, Files, Databases, other local storage, Email or other messages, Runtime arguments, and custom points specific to the application.

Attack Surface function-based categorization types

Break the Attack Surface model into different types based on function, design and technology including: Login/authentication entry points, Admin interfaces, Inquiries and search functions, Data entry CRUD forms, Business workflows, Transactional interfaces/APIs, Operational command and monitoring interfaces/APIs, Interfaces with other applications/systems, and custom types specific to the application.

Attack Surface validation through use case walkthrough

Validate and fill in understanding of the Attack Surface by walking through main use cases such as signing up, creating a profile, logging in, searching, placing orders, and changing orders. Follow the flow of control and data through the system to see how information is validated, where it is stored, what resources are touched and what other systems are involved.

Give your agent this brain