Hacktica DSMM Entities (E1–E4)

Hacktica DSMM Entities (E1–E4) EntityNameDescriptionE1Input Layer (App Entities)Fields and structures controlled by the user in the request payload→ Param Name, Param Value, POST body, JSON, XML, Multipart, etc.→ Request Headers (custom, standard), Cookies→ Referrer Header, User-Agent Header→ File UploadsCommon use: Signature detection, meta character rules, size checksE2Source Identity LayerNetwork and contextual origin of the request→…
Read More

Indexed Prevention Elements

SARC → PA Indexed Prevention Elements D1. Signatures [S1] RCE AV (Remote Command Execution) [S2] SQLi (SQL Injection) [S3] XSS (Cross-site Scripting) [S4] LFI (Local File Inclusion) [S5] RFI (Remote File Inclusion) [S6] Specific exploit signature [S7] Generic exploits signature [S8] Informational signature [S9] Global signature – request level [S10] Param-level signature [S11] URL param-level…
Read More

Application Common Attack Vectors (A-CAV)

Hackitca Attack index 🟧 1. Web Exploits (Request-Based Attacks) SQL Injection OS Command Injection Remote/Local File Inclusion (RFI/LFI) Directory Traversal / Path Traversal HTTP Smuggling HTTP Request Splitting Buffer Overflow Server Misconfiguration Improper Input Handling Web Defacement 🟨 2. Client-Side Attacks Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Clickjacking Autocomplete Attribute Abuse Weak Password Recovery…
Read More

Risk Mitigation Score (RMS)

RMS is a custom security metric developed by Hacktica to quantify how effectively a security control (like a WAF or bot manager) reduces real-world risk. Hacktica RMS Strengths: 1.Focuses on Controls — Not just risk exposure, but whether the WAF actually mitigates threats. 2.Modular & Transparent — Clear test categories (e.g., SQLi, XSS, Bots, Brute…
Read More

Automated Traffic Threats

Hacktica DSMM define Automated traffic threat 4 category 1.Data Collect (Automated data harvesting and scraping) 2.Payloads Submit (Spamming and sending misleading data, Fake accounts and registration abuse) 3.Transactions Tweak (Manipulating purchases, trades, and inventory) 4.Traffic Divert (Skewing results and redirecting traffic) •
Read More

Defensive Security Management Methodology (DSMM)

DSMM (Defensive Security Management Methodology) is turning security operations into measurable, value-driven engineering. Security is measurable .DSMM is Hacktica’s proprietary methodology that translates defensive security work into measurable business value. Instead of relying on assumptions, DSMM evaluates how well your protection plan performs — using defined process lists, command-based validations, and real-world attack simulations. What…
Read More

Terminology

Brute force – Application brute force DDoS – Application layer DDoS, floods with distbueted Vul hunting – any vulenrabilties rlated. XSS, SQLi, Full CAV bundle – includes all the main families above. SDLC security products Efficacy test products security Static scanner SPLC TMA PT = testing automation SCT Updates AMI3A
Read More

 Part 0 intro  – Web economy

Web applications are the ultimate free market to sell any goods, it is also open 24/7/365 for hacking The web application ecosystem  Web applications change the world and create the web application economy revolution where any one with a good idea can build a web application to provides products or services and monetize with end…
Read More

WAF Workshop FAQ

WAF have many considerations throughout its life cycle. Getting your WAF to good enough security requires a solid review of Assents, Implementations and Response (AIR model) Workshops are small chunks of process that should be done when managing security deviceWorkshop is not a training. It is a hands-on workshop that is done with the customer.The…
Read More