Validation in web applications is an essential step in eliminating or reducing the risk of compromise. XSS, injection, CSRF, Unvalidated Redirects, and Forward attacks all take advantage of shortcomings in the application that allow the manipulation of fields, exposure of previously hidden features or unused components, and a lack of syntax enforcement. Some additional Validation-style attacks are listed here and are typically detected well by full-feature scans and proxy tools:
- CSS-injection: CSS injection looks for code inside Common Style Sheets (not to be confused with XSS or Cross-Site Scripting) that is susceptible to manipulation or injection attacks. Like XSS and CSRF, this can be used to insert scripts or cause traffic rerouting, which results in either the exfiltration of data or the capture of credentials, tokens, and other sensitive...