---
title: "Research · 2 Application & Identity Security · VORNAC"
description: "OWASP-adjacent vulnerability classes — from XSS to business logic flaws. 7 curated notes across featured, reference, and background tiers."
url: https://www.vornac.com/en/research/application-identity
lang: en
published: 2026-06-02
updated: 2026-06-02
alternate_de: https://www.vornac.com/research/application-identity
---

[Research Index](https://www.vornac.com/en/research) / 2 · Application & Identity Security

VORNAC RESEARCH

2

# Application & Identity Security.

OWASP-adjacent vulnerability classes — from XSS to business logic flaws.

7

Notes in this domain

5

Featured

1

Reference

1

Background

Featured

Featured

9 phases

### [Common Web Vulnerabilities](https://www.vornac.com/en/research/application-identity/common-web-vulnerabilities)

The canonical vulnerability catalog: every class with at least one concrete proof-pattern. The single most-cited entry in the index.

XSS SQL Injection CSRF Command Injection SSRF Deserialization File Upload IDOR XXE / Path Traversal

Featured

7 phases

### [Web Attack & Defense — Canonical Reference](https://www.vornac.com/en/research/application-identity/web-attack-defense-canon)

Each vulnerability class presented as an attack/defense pair, with the briefing-level overview and the protocol/header/encoding points where weaknesses recur.

XSS SQL Injection CSRF SSRF Command Injection File Upload IDOR

Featured

2 phases

### [XSS — Comprehensive Reference](https://www.vornac.com/en/research/application-identity/xss-comprehensive)

The full XSS landscape: reflected, stored, DOM, mutation. Sink-versus-source structuring, CSP/WAF bypass, hook-and-control patterns, and the conditions under which payloads become worm-like.

XSS DOM XSS

Featured

2 phases

### [Injection, SSRF & XXE](https://www.vornac.com/en/research/application-identity/injection-and-traversal)

Server-side request forgery, XML external entity weaponization, and path-traversal cousins — vector enumeration, blind-channel exfiltration, parser-quirk routing.

SSRF XXE / Path Traversal

Featured

5 phases

### [Authentication, Logic & Architecture Flaws](https://www.vornac.com/en/research/application-identity/authentication-and-logic)

Password-recovery logic flaws, JWT/CORS/TLS architecture issues, the working top-10 business-logic patterns, and how a real intrusion looks in logs vs. test traffic.

Business Logic Session Mgmt CORS / TLS / JWT API Security Authentication

Reference

Reference

### [Server-Side Language Audits — Java, PHP, SQLmap](https://www.vornac.com/en/research/application-identity/server-side-language-audits)

Stack-specific notes for Java and PHP — deserialization gadgets, expression-language injection, tainted-input flow — paired with SQLmap operator flags and the OWASP testing checklist.

SQL InjectionDeserializationFile UploadXXE / Path TraversalCommand InjectionXSSCSRFIDORMethodology

Background

-   [Mobile Platform Security — Android, iOS, macOS](https://www.vornac.com/en/research/application-identity/mobile-platform-security)

    Per-platform attack surface and skills reference: Android permission model and APK static/dynamic attacks, iOS entitlement reasoning, macOS TCC and codesign.

    —

[Previous domain 1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) [All eight domains](https://www.vornac.com/en/research) [Next domain 3 · Cloud & Modern Infrastructure](https://www.vornac.com/en/research/cloud-infrastructure)

From reference to evidence

## Validate these gaps in your own environment.