Injection: Injection refers to a vulnerability where untrusted data is incorporated into a command or query, allowing an attacker to manipulate the execution of the program. This skill should be measured in the test to evaluate the ability of candidates in preventing and detecting injection attacks, which can lead to unauthorized access, data breaches, and system compromises.
Broken Authentication: Broken Authentication refers to vulnerabilities that arise from poor implementation of authentication and session management mechanisms. It can result in unauthorized access, identity theft, and exposure of sensitive user information. Measuring this skill in the test helps assess the candidates' understanding of secure authentication practices and their ability to identify and address authentication flaws.
Sensitive Data Exposure: Sensitive Data Exposure refers to instances where sensitive information, such as passwords or credit card details, is exposed due to poorly implemented security controls. This skill is measured in the test to assess the candidates' knowledge of secure data handling practices and their ability to identify and mitigate vulnerabilities that could lead to data breaches and privacy violations.
XML External Entities (XXE): XML External Entities (XXE) is a vulnerability that occurs when an XML parser is insecurely configured and allows external entities to be defined and processed. This can be exploited to read sensitive files, perform server-side requests, or launch denial-of-service attacks. Measuring this skill in the test helps evaluate candidates' understanding of secure XML processing and their ability to detect and prevent XXE vulnerabilities.
Broken Access Control: Broken Access Control refers to weaknesses in access control mechanisms that allow unauthorized users to gain elevated privileges or access sensitive resources. Measuring this skill in the test helps assess candidates' understanding of access control principles and their ability to identify and mitigate access control vulnerabilities to prevent unauthorized actions and data exposure.
Security Misconfiguration: Security Misconfiguration refers to insecure configuration settings and defaults that can leave systems and applications vulnerable to attacks. This skill is measured in the test to evaluate candidates' knowledge of secure configuration practices and their ability to identify and rectify misconfigurations that could lead to security breaches and unauthorized access.
Cross-Site Scripting (XSS): Cross-Site Scripting (XSS) refers to a vulnerability that occurs when malicious scripts are injected into web pages viewed by other users. This can lead to theft of sensitive information, session hijacking, and defacement of websites. Measuring this skill in the test helps assess candidates' understanding of XSS vulnerabilities, their ability to identify and mitigate XSS attacks, and their knowledge of secure coding practices.
Insecure Deserialization: Insecure Deserialization refers to vulnerabilities that arise when untrusted data is deserialized without proper validation and sanitization. Exploiting this vulnerability can result in remote code execution, tampering with object state, or denial-of-service attacks. Measuring this skill in the test helps evaluate candidates' understanding of secure deserialization practices and their ability to detect and prevent insecure deserialization vulnerabilities.
Using Components with Known Vulnerabilities: Using Components with Known Vulnerabilities refers to the use of outdated or vulnerable third-party libraries, frameworks, or plugins that can introduce security weaknesses into an application. Measuring this skill in the test helps assess candidates' awareness of the risks associated with using such components and their ability to identify and mitigate vulnerabilities arising from using components with known vulnerabilities.
Insufficient Logging and Monitoring: Insufficient Logging and Monitoring refers to the absence or inadequacy of logging and monitoring mechanisms, which can impede timely detection and response to security incidents. Measuring this skill in the test helps evaluate candidates' understanding of the importance of effective logging and monitoring, and their ability to assess and implement appropriate logging and monitoring measures to detect and respond to security events.
