Command Injection, also called Shell Injection, is similar to a SQL injection. But instead of injecting into a SQL query, a threat actor injects a command into the OS. According to OWASP, Command Injection’s goal is to execute arbitrary commands on the host operating system via a vulnerable application.

Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. The attacker-supplied OS commands usually execute with the vulnerable application’s privileges.

In other words, Command Injection attacks inject OS commands. This allows hackers to compromise the entire application, take full control of the server – even attack other systems within the organization.

Not what it sounds like. Forced Browsing, also called Directory Enumeration, is a brute force attack technique to gain access to restricted pages or other sensitive resources in a web server. It does this by forcing or guessing the URL directly.

If the restricted URLs, scripts, or files lack appropriate authorization, these resources can be vulnerable to forced browsing attacks. This would hypothetically allow hackers to access restricted files and view sensitive information.

XML External Entity (XXE) Injection is a web security vulnerability allowing an attacker to interfere with an application’s processing of XML data.

In other words, targeting applications that transmit data between browser and server in XML format. By intercepting and modifying the data, an attacker can exploit potentially dangerous features of standard XML libraries.

These would include the parsing and loading of external entities to gain access to the server’s filesystem or interaction with backend systems that the application has access to. Sometimes an attacker can escalate an XXE attack to perform server-side request forgery (SSRF) attacks.