A New Ontology of Unwanted Web Automation
summary
A concrete ontology of unwanted web automation is published as an OWASP project and a short handbook, claiming a distilled set of about 20 threat types derived from ~600 data points across 150 sources; it maps events to CMSS, SCAP, CWE and CAPEC and proposes detection points (system and user trend exceptions, AppSensor-style hooks) plus mitigation categories. Outputs are a shared vocabulary, practical threat definitions, sector use cases (pen‑test reporting, intelligence sharing) and a road map to link each threat to symptoms and defenses.
AI-written summary · about
chapters (19)
- 0:00Start
- 4:41Account enumeration Aggregation
- 5:51Definition
- 7:40Defining application development security requirements
- 8:34Sharing intelligence within a sector
- 9:17Exchanging threat data between CERTS
- 9:58Enhancing application penetration test findings
- 10:58Specifying service acquisition needs
- 11:50Characterising vendor services
- 15:06Literature review
- 23:24Card Cracking Identify missing start/expiry dates and security codes for stolen payment card data by trying different values.
- 24:13Carding Multiple payment authorisation attempts used to verify the validity of bulk stolen payment card data.
- 24:53OAT-008 Credential Stuffing Mass log in attempts used to verify the validity of stolen username/password
- 26:45Sniping Last minute bid or offer for goods or services
- 27:14Application Consumption
- 31:51OAT-020 Account Aggregation OAT-011 Scraping
- 32:54Fingerprinting
- 37:13Automated Threats to Web Applications
- 38:54Questions
related talks
32mAutomating Web Application Bug Hunting
26mOpenSec and Why WebAppSec Matters
23mWeb Application Security - owasp top 10 vulnerabilities
37mAutomatic Extraction of Indicators of Compromise for Web App.
38mFree security resources that your competitors use!
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
34mThreat Model-as-Code
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...