What types of attacks are specific for server-side web, but not client-side? From what I have found on the Web the most attacks focus on client-side rather than server-side.


Just looking at the OWASP Top 10, most issues are server-side:

  • A1 Injection: SQL Injection, Command Injection, etc.
  • A2 Broken Authentication
  • A3 Sensitive Data Exposure
  • A4 XXE
  • A5 Broken Access Control (OWASP places eg directory traversal here, as well as IDOR, privilege escalation, etc)
  • A6 Security Misconfiguration (mostly server-side)
  • A8 Insecure Deserialization
  • A9 Using Components with Known Vulnerabilities (mostly server-side)
  • A10 Insufficient Logging & Monitoring

They also list some server-side issues under "Additional risks to consider" such as unrestricted file upload, application-level DOS, or SSRF.

The only issue that could be classified as client-site is:

  • A7 XSS

OWASP doesn't list a lot of client-site issues though. Some, such as CSRF, Open Redirect, or Clickjacking are listed under additional risks. OWASP also places some issues that are exploited client-side in the above categories (eg CORS issues under broken access control).

Note also that while XSS is often considered a client-side issue, classification isn't that easy, as the vulnerability itself is mostly introduced server-side.

|improve this answer|||||

A SQL Injection would be an example of a server-side attack because the code that is "injected" is run on the SQL server.

|improve this answer|||||
  • 1
    Could you expand this answer to include a few more examples of server side web app attacks? – Daisetsu Oct 11 '18 at 2:57

There are several attacks varying form CSRF, DDOS, Website defacement, etc. The best place to get idea of the top attacks is OWASP (Open Web Application Security Project) project site:


They update and maintain the top threats and recommendations on mitigation. You may refer the Top 10 threats on following link form the project site:


|improve this answer|||||

Exploit Db can also give you idea about both client side and server side vulnerabilities. Its Web Application Exploits section could be useful for you. Therefore, you may have idea about the attack types. I would look for found vulnerabilities in both client side and server side frameworks. For server side ( back-end ) frameworks; You can check on Exploit-DB and also in other websites with the keywords of server side frameworks; Example: ASP.NET, Ruby On Rails, PHP.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.