Introduction to Web Attacks

Why web attacks matter

Web applications are the most common attack surface for businesses today. Compromising an external-facing web application can pivot to an internal network, leading to stolen assets or disrupted services. Even organizations with no external web apps typically have internal web apps or external API endpoints, both vulnerable to the same attack classes.

HTTP Verb Tampering

Exploits web servers that accept many HTTP verbs and methods. Sending requests with unexpected HTTP methods can:

• Bypass the web application’s authorization mechanism
• Bypass security controls against other web attacks (e.g., filters that only check specific methods)

Part of a broader class of HTTP attacks that exploit web server configuration weaknesses.

Insecure Direct Object References (IDOR)

Among the most common web vulnerabilities. Arises when a web application exposes direct references to files or resources (e.g., sequential numbers, user IDs) without a robust access control mechanism on the back-end.

An attacker can access other users’ files or data by guessing or calculating a valid resource ID — no special exploitation required beyond manipulating a parameter.

XML External Entity (XXE) Injection

Targets web applications that process XML input using outdated XML libraries. Malicious XML payloads can:

• Disclose local files on the back-end server (configuration files, source code, credentials)
• Enable Whitebox Penetration Testing if source code is leaked
• Steal server credentials and potentially achieve remote code execution by compromising the hosting server