0

Is there any classification of vulnerabilities ?

As we know, there are many vulnerabilities, such as: SQL injection vulnerability, File upload vulnerability, File contains vulnerability, XSS, SSRF, XXE, database leak and so on.

but I did not find an authoritative classification of vulnerabilities.

who can give authoritative classification of them? such as category about Operation System / Web application / Networking. and under the Web application vulnerability, there should have XSS/SSRF/XXE....

Improve this question

1 Answer 1

Reset to default
1

You may review security testing frameworks and methodology; the group you mentioned falls under The Open Web Application Security Project® (OWASP). https://owasp.org/www-project-top-ten/

For non-web control such as Human, Physical, Wireless, Telecommunications, and Networks, you may consider the OSSTMM framework. Both OWASP and OSSTMM are security testing methodologies; OWASP is considered BlackBox testing, whereas the OSSTMM is gray-box testing.

The vulnerabilites can be scored using for example

  • CVSS common vulnerabilities scoring system

    CWSS common weakness scoring system

    CWE Common Weakness Enumeration

Please note: At the end of any of the testing practice of VAPT, you as tester need to include the scoring system in your report, so you can grantee unified understanding of the risk between you business owner the coming integrator.

Improve this answer
3
  • I don't mean vulnerabilities testing, I want to classify them. the base level should be Networking /OS /Web Application . and under Web Application there should like: XSS/ SSRF/ ...
    – aircraft
    Sep 9, 2020 at 4:40
  • @aircraft Well then your question needs to be clearer, because I still don't understand what it is you want.
    – drewiepooey
    Sep 9, 2020 at 8:30
  • @aircraft the base level you mentioned, is handled under the Attack Vector, I would recommend you read the CVSS base-score -> Attack Vector (AV), where they mentioned Networkd,Adjacent,Local (machine), and physical
    – 0xFK
    Sep 14, 2020 at 3:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .