Looking for a taxonomy of web attacks

Question

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.

Answer 1

Your question is a bit vague, so I don't know exactly what you are looking for. However, in this paper a taxonomy based on HTTP methods is described: http://140.127.40.47/psnl/publications/2008ICHIT_taxonomy.pdf

Answer 2

The attacks I know about are:

• SQL injection
• Cross site scripting (XSS)
• Cross site request forgery
• Session hijacking
• Bruteforce attacks
• Executable code in uploads
• Command line injection
• Session fixation

I think if anyone has something close to a taxonomy for web based attacks it will be OWASP.