WASC

Summary

The WASC Threat Classification is a cooperative effort to clarify and organize the threats to the security of a website. It outlines the attacks and weaknesses that can lead to the compromise of a website, its data or its users. The version used in this section is WASC Threat Classification v2.0.

Definitions

Definition	Requirements
WASC-A_42. Abuse of functionality	258. Filter website content 266. Disable insecure functionalities
WASC-A_11. Brute force	237. Ascertain human interaction 327. Set a rate limit
WASC-A_07. Buffer overflow	158. Use a secure programming language 164. Use optimized structures 173. Discard unsafe inputs 072. Set maximum response time
WASC-A_12. Content spoofing	173. Discard unsafe inputs 176. Restrict system objects 265. Restrict access to critical processes 320. Avoid client-side control enforcement 342. Validate request parameters 035. Manage privilege modifications 096. Set user's required privileges
WASC-A_18. Credential and session prediction	173. Discard unsafe inputs 175. Protect pages from clickjacking 030. Avoid object reutilization
WASC-A_08. Cross-site scripting	173. Discard unsafe inputs 029. Cookies with security attributes
WASC-A_09. Cross-site request forgery	174. Transactions without a distinguishable pattern 349. Include HTTP security headers 029. Cookies with security attributes
WASC-A_10. Denial of service	327. Set a rate limit 345. Establish protections against overflows 072. Set maximum response time
WASC-A_26. HTTP request smuggling	173. Discard unsafe inputs 266. Disable insecure functionalities 345. Establish protections against overflows 062. Define standard configurations
WASC-A_03. Integer overflows	345. Establish protections against overflows
WASC-A_29. LDAP injection	173. Discard unsafe inputs
WASC-A_30. Mail command injection	181. Transmit data using secure protocols 266. Disable insecure functionalities
WASC-A_31. OS commanding	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
WASC-A_33. Path traversal	173. Discard unsafe inputs 320. Avoid client-side control enforcement 342. Validate request parameters
WASC-A_34. Predictable resource location	237. Ascertain human interaction 261. Avoid exposing sensitive information 327. Set a rate limit 037. Parameters without sensitive data
WASC-A_05. Remote file inclusion (RFI)	173. Discard unsafe inputs 265. Restrict access to critical processes 266. Disable insecure functionalities
WASC-A_37. Session fixation	030. Avoid object reutilization
WASC-A_19. SQL injection	169. Use parameterized queries 173. Discard unsafe inputs
WASC-A_38. URL redirector abuse	324. Control redirects
WASC-A_39. XPath injection	173. Discard unsafe inputs
WASC-A_46. XML injection	173. Discard unsafe inputs
WASC-W_15. Application misconfiguration	142. Change system default credentials 161. Define secure default options 062. Define standard configurations
WASC-W_16. Directory indexing	176. Restrict system objects 266. Disable insecure functionalities
WASC-W_17. Improper filesystem permissions	176. Restrict system objects 186. Use the principle of least privilege 264. Request authentication 320. Avoid client-side control enforcement 096. Set user's required privileges
WASC-W_20. Improper input handling	169. Use parameterized queries 173. Discard unsafe inputs
WASC-W_22. Improper output handling	160. Encode system outputs
WASC-W_13. Information leakage	176. Restrict system objects 177. Avoid caching and temporary files 261. Avoid exposing sensitive information 300. Mask sensitive data
WASC-W_21. Insufficient anti-automation	237. Ascertain human interaction
WASC-W_01. Insufficient authentication	227. Display access notification 228. Authenticate using standard protocols 229. Request access credentials 231. Implement a biometric verification component 235. Define credential interface 264. Request authentication 323. Exclude unverifiable files
WASC-W_02. Insufficient authorization	114. Deny access with inactive credentials 176. Restrict system objects 320. Avoid client-side control enforcement 341. Use the principle of deny by default 035. Manage privilege modifications 096. Set user's required privileges
WASC-W_49. Insufficient password recovery	126. Set a password regeneration mechanism 141. Force re-authentication 238. Establish safe recovery
WASC-W_40. Insufficient process validation	337. Make critical logic flows thread safe
WASC-W_47. Insufficient session expiration	335. Define out of band token lifespan 369. Set a maximum lifetime in sessions 023. Terminate inactive user sessions 030. Avoid object reutilization
WASC-W_04. Insufficient transport layer protection	181. Transmit data using secure protocols 336. Disable insecure TLS versions
WASC-W_14. Server misconfiguration	062. Define standard configurations

Last updated

2023/09/18