CSRF, XXE, and 12 Other Security Acronyms Explained

Acronyms are shortcuts, and we love using them, specially the catchy ones! Let's decipher some commonly used acronyms in the cyber security industry.

OWASP

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. The OWASP Top 10 is one their popular projects.

XSS

It stands for Cross-Site Scripting. An X is used instead of the C to prevent confusion with Cascading Style Sheets (CSS).

Read more about Cross-Site Scripting vulnerability

SQLI

SQL Injection, is an attack where the SQL commands used in an application are manipulated by attacker. SQLI is a dangerous and common vulnerability. Find SQL Injection on your website with SmartScanner now.

Read more about SQL Injection vulnerability

RCE

Remote Command Execution (RCE) is a high-risk vulnerability. It can occur anywhere from routers to online shops. By exploiting RCE, an attacker can execute commands (usually OS commands) on the target system.

Read more about Remote Command Execution vulnerability

DoS and DDos

Denial of Service (DoS) is a famous security acronym. You might have heard it at the news. DoS is a type of attack that makes the target service unavailable. Attackers usually perform DoS attacks by sending enormous traffic to the target.

Distributed Denial of Service (DDoS) is a DoS attack from many different sources. This type of DoS typically runs using zombie botnets.

CSRF

CSRF (pronounce Sea Surf) stands for Cross-Site Request Forgery. CSRF (aka XSRF) is an attack where the attacker sends a request on behalf of a victim user without her knowledge. Attackers exploit CSRF to do actions using the victim's permission. For example, a hacker can create an admin user for himself using a CSRF attack.

XXE

An XML External Entity attack is a kind of attack against an application that parses XML input. In this attack, the vulnerable application processes a reference to an external entity in the provided XML. The XXE is a dangerous attack that can lead to information disclosure or denial of service attacks.

SSRF

In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources.

SSI

A Server-Side Includes Injection is a type of security attack that exploits the Service-side Includes features of a web server. The Server-side includes are tags in HTML files. The web server executes these tags to add dynamic contents to the page before sending it to the user.

RFI

Remote File Inclusion (RFI) occurs when the web application downloads and executes a remote file. This remote file is usually controlled by an attacker and is passed as a request parameter.

Read more about Remote File Inclusion vulnerability

LFI / LFD

Local File Inclusion (LFI) is similar to a remote file inclusion vulnerability, but only local files on the server can be included for execution. It does not mean the LFI is less dangerous than RFI.

When the local file is only opened and sent back to the user (or attacker), it is called Local File Download or Disclosure.

Read more about Local File Inclusion

IDOR

IDOR stands for Insecure Direct Object Reference. It is a vulnerability that occurs when a reference to an internal object, such as a file or directory, is retrieved from user-supplied input. If no proper authorization is implemented, an attacker can abuse this reference to access every object.

CVE

The Common Vulnerabilities and Exposures (CVE) system provides a mechanism for referencing publicly known security vulnerabilities.

CWE

The Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities.