From b2b9a94eb87816babac012b2281192bdf638e34a Mon Sep 17 00:00:00 2001 From: Srinivas Chippagiri Date: Tue, 10 Nov 2026 12:33:38 -0800 Subject: [PATCH 1/3] Add a page on the OWASP Automated Threats to Web Applications project --- .../08-automated-threats.md | 78 +++++++++++++++++++ mkdocs-pdf-en.yaml | 1 + mkdocs.yaml | 1 + 3 files changed, 80 insertions(+) create mode 100644 docs/en/04-design/01-threat-modeling/08-automated-threats.md diff --git a/docs/en/04-design/01-threat-modeling/08-automated-threats.md b/docs/en/04-design/01-threat-modeling/08-automated-threats.md new file mode 100644 index 00000000..1a975081 --- /dev/null +++ b/docs/en/04-design/01-threat-modeling/08-automated-threats.md @@ -0,0 +1,78 @@ +The OWASP [Automated Threats to Web Applications][oatproject] project names and classifies the ways +that web applications are misused by automated software, such as bots and scripts. +It is an OWASP Lab project, and its main output is the [OWASP Automated Threat Handbook][handbook]. + +#### What are automated threats? + +Automated threats are attacks where software, rather than a person, repeatedly uses valid functionality of a web application +in a way that harms the application owner or its users. +They are different from exploiting a vulnerability: every individual request can be legitimate, +for example a single login attempt or a single product search, +and the harm only comes from doing it at scale or for a different purpose. + +The project defines 21 threat events, each with an OAT identifier: + +* OAT-001 Carding +* OAT-002 Token Cracking +* OAT-003 Cost-Inflation Fraud (previously Ad Fraud) +* OAT-004 Fingerprinting +* OAT-005 Scalping +* OAT-006 Expediting +* OAT-007 Credential Cracking +* OAT-008 Credential Stuffing +* OAT-009 CAPTCHA Defeat +* OAT-010 Card Cracking +* OAT-011 Scraping +* OAT-012 Cashing Out +* OAT-013 Sniping +* OAT-014 Vulnerability Scanning +* OAT-015 Denial of Service +* OAT-016 Skewing +* OAT-017 Spamming +* OAT-018 Footprinting +* OAT-019 Account Creation +* OAT-020 Account Aggregation +* OAT-021 Denial of Inventory + +#### Why use it? + +Most of these threats are not covered by the OWASP Top 10 or by vulnerability scanners, +because the application is working as designed - it is the way it is being used that causes the harm. +They also often have sector-specific names, for example 'sneaker bots' for scalping, +which makes it hard for business owners, developers and security teams to talk about the same problem. + +The OAT identifiers provide a common language for this. +During threat modeling they act as a checklist of the automated misuse that a feature could attract, +and in requirements they allow a specific outcome to be stated, +for example that the payment functions must not be susceptible to OAT-001 Carding or OAT-010 Card Cracking, +rather than naming a particular product such as a bot management service. + +#### How to use it + +When threat modeling a feature, ask which of the threat events apply to it: +login and password reset pages attract Credential Stuffing and Credential Cracking, +sign up pages attract Account Creation, checkout pages attract Carding and Card Cracking, +and limited stock or booking systems attract Scalping, Sniping and Denial of Inventory. +The project's [threat identification chart][oatchart] helps decide which threat event matches an observed behavior. + +Each threat event in the handbook describes the symptoms and the possible countermeasures, +and these can be used to define the security requirements and the monitoring that the feature needs. +The OWASP [Bot Management and Anti-Automation Cheat Sheet][csbot] gives practical guidance on implementing those countermeasures. + +#### References + +* OWASP [Automated Threats to Web Applications][oatproject] project +* OWASP [Automated Threat Handbook][handbook] +* OWASP [Bot Management and Anti-Automation Cheat Sheet][csbot] + +---- + +The OWASP Developer Guide is a community effort; if there is something that needs changing +then [submit an issue][issue040108] or [edit on GitHub][edit040108]. + +[csbot]: https://cheatsheetseries.owasp.org/cheatsheets/Bot_Management_and_Anti-Automation_Cheat_Sheet +[edit040108]: https://github.com/OWASP/DevGuide/blob/main/docs/en/04-design/01-threat-modeling/08-automated-threats.md +[handbook]: https://github.com/OWASP/www-project-automated-threats-to-web-applications/tree/master/assets/files/EN +[issue040108]: https://github.com/OWASP/DevGuide/issues/new?labels=content&template=request.md&title=Update:%2004-design/01-threat-modeling/08-automated-threats +[oatchart]: https://owasp.org/www-project-automated-threats-to-web-applications/assets/files/oat-ontology-decision-chart.pdf +[oatproject]: https://owasp.org/projects/automated-threats-to-web-applications diff --git a/mkdocs-pdf-en.yaml b/mkdocs-pdf-en.yaml index b2a8175d..346c839d 100644 --- a/mkdocs-pdf-en.yaml +++ b/mkdocs-pdf-en.yaml @@ -63,6 +63,7 @@ nav: - LINDDUN GO: en/04-design/01-threat-modeling/05-linddun-go.md - Threat Model Library: en/04-design/01-threat-modeling/06-threat-model-library.md - Threat modeling in practice: en/04-design/01-threat-modeling/07-practical-threat-modeling.md + - Automated threats: en/04-design/01-threat-modeling/08-automated-threats.md - Web application checklist: - Overview: en/04-design/02-web-app-checklist/index.md - Secure by Default: en/04-design/02-web-app-checklist/01-secure-by-default.md diff --git a/mkdocs.yaml b/mkdocs.yaml index 23976f5a..e6548a6d 100644 --- a/mkdocs.yaml +++ b/mkdocs.yaml @@ -84,6 +84,7 @@ nav: - LINDDUN GO: en/04-design/01-threat-modeling/05-linddun-go.md - Threat Model Library: en/04-design/01-threat-modeling/06-threat-model-library.md - Threat modeling in practice: en/04-design/01-threat-modeling/07-practical-threat-modeling.md + - Automated threats: en/04-design/01-threat-modeling/08-automated-threats.md - Web application checklist: - Overview: en/04-design/02-web-app-checklist/index.md - Secure by Default: en/04-design/02-web-app-checklist/01-secure-by-default.md From e86a4fd6e2a3912f560a5d7158357cb025a264b5 Mon Sep 17 00:00:00 2001 From: Srinivas Chippagiri Date: Tue, 10 Nov 2026 12:33:54 -0800 Subject: [PATCH 2/3] Wrap a long line --- docs/en/04-design/01-threat-modeling/08-automated-threats.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/en/04-design/01-threat-modeling/08-automated-threats.md b/docs/en/04-design/01-threat-modeling/08-automated-threats.md index 1a975081..d8d96237 100644 --- a/docs/en/04-design/01-threat-modeling/08-automated-threats.md +++ b/docs/en/04-design/01-threat-modeling/08-automated-threats.md @@ -57,7 +57,8 @@ The project's [threat identification chart][oatchart] helps decide which threat Each threat event in the handbook describes the symptoms and the possible countermeasures, and these can be used to define the security requirements and the monitoring that the feature needs. -The OWASP [Bot Management and Anti-Automation Cheat Sheet][csbot] gives practical guidance on implementing those countermeasures. +The OWASP [Bot Management and Anti-Automation Cheat Sheet][csbot] gives practical guidance +on implementing those countermeasures. #### References From ee2db30ee013be642bb5c9f60d6fc615fb5a2325 Mon Sep 17 00:00:00 2001 From: Srinivas Chippagiri Date: Tue, 10 Nov 2026 23:10:20 -0800 Subject: [PATCH 3/3] Fix the Sniping example and the Top 10 wording Signed-off-by: Srinivas Chippagiri --- .../04-design/01-threat-modeling/08-automated-threats.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/en/04-design/01-threat-modeling/08-automated-threats.md b/docs/en/04-design/01-threat-modeling/08-automated-threats.md index d8d96237..788551ba 100644 --- a/docs/en/04-design/01-threat-modeling/08-automated-threats.md +++ b/docs/en/04-design/01-threat-modeling/08-automated-threats.md @@ -36,8 +36,8 @@ The project defines 21 threat events, each with an OAT identifier: #### Why use it? -Most of these threats are not covered by the OWASP Top 10 or by vulnerability scanners, -because the application is working as designed - it is the way it is being used that causes the harm. +None of these threats are implementation bugs, so they don't show up as findings from a vulnerability scan +or map neatly onto the OWASP Top 10. The application is working as designed; it's the way it is used that causes the harm. They also often have sector-specific names, for example 'sneaker bots' for scalping, which makes it hard for business owners, developers and security teams to talk about the same problem. @@ -52,7 +52,8 @@ rather than naming a particular product such as a bot management service. When threat modeling a feature, ask which of the threat events apply to it: login and password reset pages attract Credential Stuffing and Credential Cracking, sign up pages attract Account Creation, checkout pages attract Carding and Card Cracking, -and limited stock or booking systems attract Scalping, Sniping and Denial of Inventory. +limited stock or booking systems attract Scalping and Denial of Inventory, +and auctions or other time-limited offers attract Sniping. The project's [threat identification chart][oatchart] helps decide which threat event matches an observed behavior. Each threat event in the handbook describes the symptoms and the possible countermeasures,