About OWASP Automated Threats to Web Applications
Description
Web applications are subjected to unwanted automated usage – day in, day out. Often these events relate to misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities. Also, excessive misuse is commonly mistakenly reported as application denial-of-service (DoS) like HTTP-flooding, when in fact the DoS is a side-effect instead of the primary intent. Frequently these have sector-specific names. Most of these problems seen regularly by web application owners are not listed in any OWASP Top Ten or other top issue list. Furthermore, they are not enumerated or defined adequately in existing dictionaries. These factors have contributed to inadequate visibility, and an inconsistency in naming such threats, with a consequent lack of clarity in attempts to address the issues.
Without sharing a common language between devops, architects, business owners, security engineers, purchasers and suppliers/vendors, everyone has to make extra effort to communicate clearly. Misunderstandings can be costly. The adverse impacts affect the privacy and security of individuals as well as the security of the applications and related system components.
Automated Threats
The list of threat events, defined more fully in the OWASP Automated Threat Handbook, is alphabetically:
Not sure which is which? Use the threat identification chart in conjunction with the full handbook.
Licensing
All the materials are free to use. They are licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.
© OWASP Foundation
Project Resources
- GitHub
- Creative Commons Attribution-ShareAlike 3.0 license
- Risk Taxonomy, Technical Standard, The Open Group, 2009
- NISTIR 7298 rev 2, NIST
- OSI model, Wikipedia
- TCP/IP model, Wikipedia
- Architecture of the World Wide Web, Volume One, W3C
- Help and FAQ, W3C
- Common Attack Pattern Enumeration and Classification
- Domains of attack
- Supply Chain
- Software
- WASC Threat Classification
- OWASP WASC Web Hacking Incidents Database Project
- threat identification chart
- Google Group
- Open Common Requirement Enumeration (Open CRE)
Project Leaders
Tin Zaw
Colin Watson
Project Information
Lab Project
Classification
Lab
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.