Something you have, such as a token or OTP

Default user credentials

Password recovery hints

Simplified CAPTCHA challenges

Limiting cookies to same-origin requests

Preventing cookies from being accessed by JavaScript

Encrypting the cookie’s value

Ensuring cookies are only sent over HTTPS connections

Validates serialized data before deserialization

Compresses serialized objects for storage

Converts binary data into a text-friendly format

Encrypts serialized objects to prevent tampering

eXtra Managed Language

eXternal Messaging Language

eXtensible Markup Language

eXecutable Machine Language

They disrupt XML parsing if not properly escaped  

They allow attackers to inject SQL commands

They bypass input validation rules

They enable unauthorized file uploads  

Use of strong cryptographic random number generators

Weak session ID generation algorithms

Lack of HTTPS encryption for session transfers

Improper session termination practices

To track access and changes to sensitive data for accountability

To improve application performance during peak hours

To generate encrypted data transmission reports

To ensure that backups are performed consistently

Enumerating subdomains of a target domain

Extracting DNS records

Testing web application firewalls

Scanning for internet-connected devices and their vulnerabilities

Identifying server type, version, and technology stack

Detecting open ports on a network

Performing SQL injection tests

Enumerating DNS records of a server

It ensures exclusive access to resources in high-concurrency environments.

It prevents unauthorized access to encrypted data.

It simplifies session management across distributed nodes.

It speeds up database transactions.