Skip to main content

OWASP Source Mapping: Attacks × Cheat Sheets

This document maps every OWASP attack (www-community) and Cheat Sheet (CheatSheetSeries) to a security category, each linked to its canonical public page. Within a category, equivalent items share a single checklist line: the attack(s) and the cheat sheet(s) that address the same risk are listed together, comma-separated. Items with no direct counterpart stand on their own line.

  • Credit belongs to OWASP. Attacks live at https://owasp.org/www-community/attacks/<attack> and cheat sheets at https://cheatsheetseries.owasp.org/cheatsheets/<cheat>.html.

1. Injection (generic)​

2. SQL / Database Injection​

3. OS / Command Injection​

4. LDAP / XPath / XML Injection​

5. Cross-Site Scripting (XSS)​

6. Cross-Site Request Forgery (CSRF) & Clickjacking​

7. Redirects & Forwards​

8. Access Control & Authorization​

9. Authentication & Credentials​

10. Session Management​

11. Identity Federation (OAuth / SAML / JWT)​

12. Cryptography & Transport Security​

13. Server-Side Request Forgery (SSRF)​

14. Path Traversal & File Handling​

15. HTTP Protocol Abuse (Headers, Caching, Splitting)​

16. Encoding & Content Spoofing​

17. CSV / Spreadsheet Injection​

18. CORS (Cross-Origin Resource Sharing)​

19. Denial of Service​

20. Memory Safety & Native Code​

21. Mobile Code & Untrusted Code Execution​

22. Deserialization​

23. Malware & Client-Side Threats​

24. Logging, Repudiation & Error Handling​

25. Business Logic & Abuse of Functionality​

Business logic and abuse of functionality have no single code surface a per-surface sub-skill defends: the defense is application-specific design, the same reasoning the project's threat modeling drives. Moved to "Out of scope".

26. AI / LLM / Agent Security​

27. Prototype Pollution & Cross-Site Leaks​

28. Frameworks & Language Platforms​

29. Web Front-End & Browser​

30. APIs & Services​

31. Cloud, Containers & Infrastructure​

Container and workload config is config-as-code the developer ships with the app (Dockerfile, Compose, Pod securityContext), a real surface harden fixes and verify proves, so it is in scope. Cluster administration (RBAC, etcd, API server, admission, network segmentation) is the operator's domain and stays out of scope.

32. Supply Chain & CI/CD​

33. Secrets & Configuration​

Secrets management is operational: vaults, CI/CD, cloud config, rotation. The one code-level facet (a secret hardcoded in source) is a deterministic scan, not a risk sub-skill. Moved to "Out of scope".

34. Process, Design & Governance​

User privacy protection is policy and design (data minimization, transparency, retention), not a code surface a sub-skill defends. Moved to "Out of scope".

35. Payments & Compliance​

36. Embedded / IoT / Specialized Domains​

Automotive and drone security are embedded-system domains (CAN bus, OTA firmware, sensor and radio integrity, physical access), not the web/API application source Blue Spec audits. Moved to "Out of scope".

Out of scope (no code surface)​

These are not sub-skill terrains and carry no checkbox: they are governance, process, operational hardening, or framework usage with no single code surface a per-surface sub-skill defends. Their security value is real, but it lives in process and architecture (or, for a framework, in that language's own skill), not in a defense this catalog ships. Listed for reference, not as work.