| Vulnerability | Stage 1Foothold |
Stage 2Priv Esc |
Stage 3Exfil |
|---|---|---|---|
| SQL Injection | — | ||
| Cross-site Scripting (XSS) | |||
| Cross-site Request Forgery (CSRF) | |||
| Clickjacking | |||
| DOM-based Vulnerabilities | |||
| Cross-origin Resource Sharing (CORS) | |||
| XML External Entity (XXE) | — | — | |
| Server-side Request Forgery (SSRF) | — | — | |
| HTTP Request Smuggling | |||
| OS Command Injection | — | — | |
| Server-side Template Injection (SSTI) | — | — | |
| Directory / Path Traversal | — | — | |
| Access Control Vulnerabilities | |||
| Authentication Bypass | |||
| Web Cache Poisoning | |||
| Insecure Deserialization | — | — | |
| HTTP Host Header Attacks | |||
| OAuth Authentication Flaws | |||
| File Upload Vulnerabilities | — | — | |
| JWT (JSON Web Tokens) |