Learn: web security terms, answered first
Each page answers one question in its first two sentences, then shows the idea on CyberGym, a legal practice target, or on your own site, and points to the article and the feature that go deeper.
- What is an API endpoint?
- An API endpoint is one address of an API: a URL path combined with an HTTP method, such as GET /api/Products, that a client calls to read or change data. In security, each endpoint is a separate door into the application, and each one has to check on its own who is calling.
- What is attack surface mapping?
- Attack surface mapping is making an inventory of everything an application exposes to an attacker: its pages, login boundaries, API endpoints, parameters, files and third-party services. It comes before testing, because every entry on the map is a place to test, and anything missing from it never gets tested.
- What is BOLA (broken object level authorization)?
- BOLA, broken object level authorization, is an API that accepts an object ID from the caller and returns or changes that object without checking the caller is allowed to. It is the API name for IDOR, and the OWASP API Security Top 10 2023 ranks it as the first risk, API1.
- What is broken access control?
- Broken access control is any flaw that lets a user act outside their intended permissions: read another user's data, change records they do not own, or reach admin functions. It is the first category of the OWASP Top 10:2025, A01, and covers IDOR, missing role checks, forced browsing and server-side request forgery.
- What is a CTF in cybersecurity?
- A CTF, capture the flag, is a security exercise or competition in which you solve hacking challenges on targets built to be attacked, and each solved challenge reveals a secret string, the flag, that you submit for points. It is how many people first practise offensive security legally.
- What is a CVE?
- A CVE (Common Vulnerabilities and Exposures) is a unique public identifier for one disclosed vulnerability in a specific product, written as CVE-year-number, for example CVE-2026-111497. The CVE Program, run by MITRE with authorized numbering authorities, assigns it so everyone can refer to the same flaw by the same name.
- What is a CVSS score?
- CVSS, the Common Vulnerability Scoring System, rates the technical severity of a vulnerability from 0.0 to 10.0, computed from a short vector of metrics such as attack vector and privileges required. It is maintained by FIRST; version 4.0 is current, and many records still carry version 3.1 scores.
- What is a deliberately vulnerable web app?
- A deliberately vulnerable web app is an application built with known security flaws so that people can practise finding and fixing them legally. OWASP Juice Shop, DVWA and WebGoat are well-known examples. You run one yourself or use a hosted instance whose owner explicitly permits attacks, such as CyberGym.
- What is IDOR (insecure direct object reference)?
- IDOR, an insecure direct object reference, is an access-control vulnerability: an application uses an identifier from the request, such as /api/orders/1042, to fetch a record without checking that the caller may see it. Changing the number then returns somebody else's order, invoice or profile.
- What is OSINT (open-source intelligence)?
- OSINT, open-source intelligence, is information collected from publicly available sources and analysed to answer a question: search engines, DNS and certificate logs, code repositories, company filings, social media. In security it is the first step of reconnaissance, mapping what an organisation exposes before anyone sends a single request to its systems.
- What is the OWASP Top 10?
- The OWASP Top 10 is an awareness document from the Open Worldwide Application Security Project that ranks the ten most critical security risk categories for web applications. The current edition, 2025, starts with broken access control; each category groups many specific weaknesses and links to how to prevent them.
- What is penetration testing?
- Penetration testing, or pentesting, is an authorised, simulated attack on a system to find out which weaknesses an attacker could actually use and how far they could get. Unlike a scan, a pentest tries to exploit and chain findings, within a written scope, and reports each one with evidence and a fix.
- What are HTTP security headers?
- Security headers are HTTP response headers that tell the browser to switch on protections for your site, such as Content-Security-Policy, Strict-Transport-Security and X-Content-Type-Options. They do not fix bugs in your code; they limit what an attacker can do with one, and they cost a line of server configuration each.
- What is SQL injection?
- SQL injection is a vulnerability where input from a user is pasted into a database query as code instead of being passed as data, so the input can change what the query does. Depending on the query, an attacker may read other users' records, bypass a login or modify data.
- What is cross-site scripting (XSS)?
- Cross-site scripting (XSS) is a vulnerability where an application puts untrusted input into a web page without encoding it, so the browser runs it as script. The script runs as the victim, on the vulnerable site, and can read the page, act with the victim's session or change what they see.
Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.