TYPES OF VULNERABILITIES

➢ Web-Based Vulnerabilities:

1. SQL Injection (SQLi): Exploiting vulnerabilities in database queries to

manipulate or extract data.

2. Cross-Site Scripting (XSS): Injecting malicious scripts into web pages

viewed by other users.

3. Cross-Site Request Forgery (CSRF): Forcing users to perform actions on a

web application without their consent.

4. Security Misconfigurations: Improperly configured security settings or

defaults.

5. Command Injection: Executing arbitrary commands on a host through a

vulnerable web application.

6. File Inclusion: Including files on a server through a web browser.

7. Unvalidated Redirects and Forwards: Redirecting users to malicious

websites or pages.

8. Insecure Direct Object References (IDOR): Accessing unauthorized data

by manipulating object references.

➢ Network-Based Vulnerabilities:

1. Man-in-the-Middle (MitM) Attacks: Intercepting and potentially altering

communication between two parties.

2. DNS Spoofing/Poisoning: Manipulating DNS responses to redirect users

to malicious sites.

3. Denial of Service (DoS) and Distributed Denial of Service (DDoS):

Overloading network resources to make a service unavailable.
 4. ARP Spoofing/Poisoning: Associating a rogue MAC address with the IP
address of a legitimate network node.

5. Port Scanning: Identifying open ports on a system to find potential

vulnerabilities.

6. Packet Sniffing: Capturing and analyzing network traffic to obtain

sensitive information.

7. Network Eavesdropping: Listening to network communication without

authorization.

➢ Host-Based Vulnerabilities:

1. Weak Passwords: Using easily guessable or crackable passwords.

2. Outdated Software: Running software or operating systems with known

vulnerabilities.

3. Lack of Patch Management: Failing to apply security patches promptly.

4. Unnecessary Services and Ports: Running services or ports that are not
needed, increasing the attack surface.

5. Insecure Configurations: Poorly configured security settings on the host

system.

6. Privilege Escalation: Gaining unauthorized access to higher-level

permissions.

7. Malware: Installing malicious software on the host system.

8. Buffer Overflows: Exploiting programming errors to overwrite memory

and execute arbitrary code.

---------------------------------------------END---------------------------------------------