What types of attacks are specific for server-side web, but not client-side? From what I have found on the Web the most attacks focus on client-side rather than server-side.

up vote 1 down vote accepted

Just looking at the OWASP Top 10, most issues are server-side:

  • A1 Injection: SQL Injection, Command Injection, etc.
  • A2 Broken Authentication
  • A3 Sensitive Data Exposure
  • A4 XXE
  • A5 Broken Access Control (OWASP places eg directory traversal here, as well as IDOR, privilege escalation, etc)
  • A6 Security Misconfiguration (mostly server-side)
  • A8 Insecure Deserialization
  • A9 Using Components with Known Vulnerabilities (mostly server-side)
  • A10 Insufficient Logging & Monitoring

They also list some server-side issues under "Additional risks to consider" such as unrestricted file upload, application-level DOS, or SSRF.

The only issue that could be classified as client-site is:

  • A7 XSS

OWASP doesn't list a lot of client-site issues though. Some, such as CSRF, Open Redirect, or Clickjacking are listed under additional risks. OWASP also places some issues that are exploited client-side in the above categories (eg CORS issues under broken access control).

Note also that while XSS is often considered a client-side issue, classification isn't that easy, as the vulnerability itself is mostly introduced server-side.

A SQL Injection would be an example of a server-side attack because the code that is "injected" is run on the SQL server.

  • 1
    Could you expand this answer to include a few more examples of server side web app attacks? – Daisetsu Oct 11 at 2:57

There are several attacks varying form CSRF, DDOS, Website defacement, etc. The best place to get idea of the top attacks is OWASP (Open Web Application Security Project) project site:

https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

They update and maintain the top threats and recommendations on mitigation. You may refer the Top 10 threats on following link form the project site:

https://www.owasp.org/index.php/Top_10-2017_Top_10

Exploit Db can also give you idea about both client side and server side vulnerabilities. Its Web Application Exploits section could be useful for you. Therefore, you may have idea about the attack types. I would look for found vulnerabilities in both client side and server side frameworks. For server side ( back-end ) frameworks; You can check on Exploit-DB and also in other websites with the keywords of server side frameworks; Example: ASP.NET, Ruby On Rails, PHP.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.