‫Here is the classification of Web attack types.
‫It's based on OWASP testing guy always open web application security project is a worldwide not for
‫profit organization focused on improving the security of software.
‫It means you collect information about the app, attack surfaces, application users, et cetera, as
‫much as possible.
‫This information is used to determine the attack method.
‫It's a good approach to test the configurations of each mechanism, while information gathering the
‫configurations may cause weaknesses and those weaknesses might be used to hack the app.
‫Then data exchanged between the client and the server is manipulated.
‫The application is forced to make mistakes.
‫We analyze what the application does in unexpected situations.
‫Authentication mechanism is a critical part of an app.
‫We'll try to find out the flaws of the mechanism.
‫If the application has more than one user type, authorisation problems may appear.
‫We manipulate user rights and roles and try to do something that we are not allowed to do.
‫Session management mechanism is the next target.
‫The session is a unique identifier of the user and the person who steals the session of a user can act
‫as that user.
‫Business logic flaws are not found by the automated tools, analyze the procedures of the carefully.
‫Tamper with the procedure flows, change the order of procedures, etc..