vulnerability-guide

---
name: vulnerability-guide
description: Reference for common web vulnerabilities and how to explain them. Use when the user asks about XSS, SQLi, CSRF, CORS, CSP, HSTS, TLS, IDOR, SSRF, injection, cookie security, secrets, or how to fix a specific finding.
---

## Vulnerability Guide

### Security Headers
- **CSP**: Controls which resources load. Missing → XSS can load arbitrary scripts.
- **HSTS**: Forces HTTPS. Missing → SSL-stripping attacks.
- **X-Frame-Options**: Prevents clickjacking.
- **X-Content-Type-Options**: Prevents MIME-sniffing.

### Cookies
- **Secure**: Cookie only over HTTPS.
- **HttpOnly**: Invisible to JavaScript. Without → XSS steals sessions.
- **SameSite**: Controls cross-site sending. `None` needs Secure.

### TLS
- TLS 1.0/1.1: deprecated. Expired cert: browser warning. Weak ciphers: broken.

### Injection
- **SQLi**: User input in SQL unescaped.
- **SSTI**: Template evaluates input. `{{7*7}}` → `49` means vulnerable.
- **Command**: User input in shell commands.

### XSS
- Reflected (URL parameter), Stored (DB), DOM-based (client JS).
- Impact: session theft, phishing, defacement.

### Info Disclosure
- Server headers, stack traces, `.env`/`.git/config`, debug endpoints.

### Secrets
- AWS keys, Stripe keys, JWTs, private keys. Each = full compromise.

### Auth & IDOR
- User enumeration, rate limiting, timing attacks. IDOR = change URL IDs to access others' data.

### Security Misconfiguration
- Default/sample credentials, exposed admin/debug endpoints (`/wp-admin`, `/admin`, `/debug`), directory listing, verbose stack traces, unnecessary HTTP methods (`TRACE`/`PUT`), permissive CORS, open cloud storage buckets.
- Distinct from the missing-header findings above but usually reported alongside them.

### Vulnerable & Outdated Components
- Server/framework version banners (`Server`, `X-Powered-By`, `X-AspNet-Version`) map to known CVEs — cross-reference with the recon check's tech fingerprint.
- Client-side: bundled JS libraries with known CVEs, missing SRI hashes on third-party `<script src>`, unpinned CDN versions.
- White-box: pinned versions in `package.json`/`requirements.txt`/lockfiles, `Dockerfile` base images, and CI workflow actions — see `repository-audit`.
- Cite the CVE ID, not just "outdated component"; impact ranges from info leak to full RCE depending on the CVE.

### Mishandling Of Exceptional Conditions
- Malformed/oversized/negative/type-confused input causing 500s, stack traces (see Info Disclosure), unhandled rejections, or resource exhaustion.
- Evidence: a crash/stack trace on abnormal input, inconsistent error handling between similar endpoints, or a fuzzer-detected signal.

### OWASP Top 10:2025 Quick Map
Use current category names when citing OWASP in a report; SSRF is no longer a standalone category.
- A01 Broken Access Control (now explicitly includes SSRF, BOLA, BFLA) → Auth & IDOR above, SSRF in `web-attack-knowledge`.
- A02 Security Misconfiguration → above.
- A03 Software Supply Chain Failures → Vulnerable & Outdated Components above.
- A04 Cryptographic Failures → TLS + Secrets above.
- A05 Injection → Injection above.
- A06 Insecure Design, A07 Authentication Failures, A08 Software/Data Integrity Failures, A09 Logging & Alerting Failures → see `web-attack-knowledge` for business-logic, auth, and deserialization detail.
- A10 Mishandling of Exceptional Conditions → above.

### Explaining a vulnerability
1. Name + severity. 2. One-sentence explanation. 3. Real-world impact.
4. Fix (from finding's remediation + CWE). 5. Reference CWE.