Thread by @harshbothra_

#SecurityExplained S-60: Introduction to CWE

According to the official description, the CWE™ (Common Weakness Enumeration) is a community-developed list of software and hardware weakness types.

[1/n🧵]

#AppSec #infosec #websecurity #cybersecurity #bugbountytips #Pentesting

2/n
It serves as a common language, a measuring stick for security tools, and as a line for weakness identification, mitigation, and prevention efforts. The list includes more than 924 Common Weaknesses in Software & Hardware.

3/n
There are multiple options available to look for a CWE such as:
- By Software Development
- By Hardware Design
- By Research Concepts
- External Mappings such as (CWE TOP 25, OWASP TOP 10, Software Fault Pattern Cluster and more)

4/n
The CWE TOP 25 is a list of the top 25 most dangerous software weaknesses observed. These Weaknesses includes:

- Out-of-bounds Write
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Out-of-bounds Read
- Improper Input Validation

5/n
- Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
- Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- Use After Free
- Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

6/n
- Cross-Site Request Forgery (CSRF)
- Unrestricted Upload of File with Dangerous Type
- Missing Authentication for Critical Function
- Integer Overflow or Wraparound
- Deserialization of Untrusted Data
- Improper Authentication
- NULL Pointer Dereference

7/n
- Use of Hard-coded Credentials
- Improper Restriction of Operations within the Bounds of a Memory Buffer
- Missing Authorization
- Incorrect Default Permissions
- Exposure of Sensitive Information to an Unauthorized Actor
- Insufficiently Protected Credentials

n/n
- Incorrect Permission Assignment for Critical Resource
- Improper Restriction of XML External Entity Reference
- Server-Side Request Forgery (SSRF)
- Improper Neutralization of Special Elements used in a Command ('Command Injection')

GH Repo: github.com/harsh-bothra/S…