OWASP Automated Threats to Web Applications

The A-Z list of automated threat events and summary descriptions, defined in full in the OWASP Automated Threat Handbook, is: Identifier|OAT Name|Summary Defining Characteristics OAT-020|Account Aggregation|Use by an intermediary application that collects together multiple accounts and interacts on their behalf OAT-019|Account Creation|Create multiple accounts for subsequent misuse OAT-003|Ad Fraud|False clicks and fraudulent display of web-placed advertisements OAT-009|CAPTCHA Defeat|Solve anti-automation tests OAT-010|Card Cracking|Identify missing start/expiry dates and security codes for stolen payment card data by trying different values OAT-001|Carding|Multiple payment authorisation attempts used to verify the validity of bulk stolen payment card data OAT-012|Cashing Out|Buy goods or obtain cash utilising validated stolen payment card or other user account data OAT-007|Credential Cracking|Identify valid login credentials by trying different values for usernames and/or passwords OAT-008|Credential Stuffing|Mass log in attempts used to verify the validity of stolen username/password pairs OAT-021|Denial of Inventory|Deplete goods or services stock without ever completing the purchase or committing to the transaction OAT-015|Denial of Service|Target resources of the application and database servers, or individual user accounts, to achieve denial of service (DoS) OAT-006|Expediting|Perform actions to hasten progress of usually slow, tedious or time-consuming actions OAT-004|Fingerprinting|Elicit information about the supporting software and framework types and versions OAT-018|Footprinting|Probe and explore application to identify its constituents and properties OAT-005|Scalping|Obtain limited-availability and/or preferred goods/services by unfair methods OAT-011|Scraping|Collect application content and/or other data for use elsewhere OAT-016|Skewing|Repeated link clicks, page requests or form submissions intended to alter some metric OAT-013|Sniping|Last minute bid or offer for goods or services OAT-017|Spamming|Malicious or questionable information addition that appears in public or private content, databases or user messages OAT-002|Token Cracking|Mass enumeration of coupon numbers, voucher codes, discount tokens, etc OAT-014|Vulnerability Scanning|Crawl and fuzz application to identify weaknesses and possible vulnerabilities ||