Coverage of the OWASP automated threats
OWASP's Automated Threats to Web Applications project names twenty-one ways bots abuse a site's intended functions — not its bugs, its features. This page says, for each, what this system does about it, and where it does not. Covered means there is a signal aimed at the threat itself, scored by default and tested. Partial means the general bot verdict applies but nothing is aimed at the threat's own shape. Not built means what it says.
| OAT | Threat | What does it | |
|---|---|---|---|
| 001 | Carding — stolen card numbers tested through small payments | Covered | card in assess: many cards from one address or one device, declines with hardly an approval — protecting checkout |
| 002 | Token cracking — gift card numbers, vouchers, coupons guessed | Covered | code: many codes from an address or a device, refusals, one card's PIN refused again and again; at the edge with ANTIBOT_CODE_FIELDS — protecting gift cards |
| 003 | Ad fraud — fake impressions and clicks | Partial | The visitor verdict (bot, the suspect score) tells a bot's click from a person's, but there is no ad-specific product: no click validation, no reporting to an ad network |
| 004 | Fingerprinting — learning what software a site runs, to attack it | Partial | Probes for what a deploy leaves lying around are answered at the edge and never reach the site; decoys tell a refused bot nothing (decoy); headers that announce the framework are not sent by the dashboard. Banner-grabbing of the site's own stack is the site's to hide |
| 005 | Scalping — buying limited goods faster than people can | Covered | Waiting rooms admit by verdict and by place in line, per device; holds see the cart emptied into one client's; shipping reads the door an order goes to past the ways it is rewritten, and counts the accounts and cards shipping there — protecting limited releases |
| 006 | Expediting — running a multi-step flow faster than a person | Covered | flow in assess, or the steps named at the edge (ANTIBOT_FLOWS) or in a server SDK's guard (flows) with no code: each step of a checkout, a sign-up or a booking read against the step before it, by the visitor's receipt or the address — steps taken faster than a person takes them, and steps entered past the ones before — protecting checkout; the agent's interaction signals and the pulse engine judge the pages in between |
| 007 | Credential cracking — guessing one account's password | Covered | Failed sign-ins for one account, from many addresses or many devices — protecting sign-in |
| 008 | Credential stuffing — a list of stolen pairs worked through | Covered | Many accounts from one address or one device, failures with hardly a success, network reputation; at the edge with ANTIBOT_LOGIN_FIELDS; a GraphQL request that is many sign-ins — aliases of one mutation, a batch — read past every count of requests (graphql, ANTIBOT_GRAPHQL, a guard's graphql); and a sign-in from a device and a country the account never used, for a second factor |
| 009 | CAPTCHA defeat — solving challenges by machine or by farm | Partial | The challenge is proof-of-work with hold telemetry, priced by suspicion, single-use and bound to the client; a farm of people passes it like anyone, which is why what a browser runs up — accounts, failed sign-ins, cards, numbers, posts — still counts after a pass (a pass excuses only what a person who passed one is not asked again for: a message many sent, codes, holds, shipping, a user's own pace) |
| 010 | Card cracking — one card's expiry or code guessed | Covered | One card declined again and again, from anywhere — protecting checkout |
| 011 | Scraping — content and prices collected | Covered | Identification of what the client is (headers, transport, the agent's evidence), crawler verification and policies by purpose, trap links, requests all hour without a receipt, one signed-in account from a proxy pool — and, for a headless browser with a stealth layer that looks like a person on the wire, the edge's challenge posture, which makes it run the agent before its first page. What each scraping tool scores, and what is not caught yet: measured against automation tools |
| 012 | Cashing out — turning stolen value into goods | Partial | What precedes it is covered — the takeover (new device, new country), the cracked gift card — but there is no purchase-side fraud model |
| 013 | Sniping — a bid or a buy at the last moment | Partial | The verdict and rules apply at the bid; there is no auction-timing signal |
| 014 | Vulnerability scanning — probing for weaknesses | Covered | Requests for /.env, /.git/… and their like answered at the edge and their addresses marked — probes |
| 015 | Denial of service — exhausting the application | Partial | Per-address rate limits and sustained-rate signals, refused at the edge, and attack mode — every receipt-less request challenged, by hand or when an attack alert opens; volumetric floods are the CDN's to absorb |
| 016 | Skewing — clicks and views to bend a metric | Partial | The verdict filters bots out of what is counted where it is asked; there is no analytics integration |
| 017 | Spamming — comments, reviews, contact forms | Covered | content: one message from many senders, what moderators reported, many posts from one address or one device, many links; at the edge with ANTIBOT_CONTENT_FIELDS — protecting forms |
| 018 | Footprinting — mapping a site's unlinked paths and functions | Covered | At the edge: twenty different pages the site answers as missing, asked for from one address in ten minutes, mark it as a trap hit does — walks; trap links and probes catch the walk where it reaches them |
| 019 | Account creation — accounts made in bulk | Covered | Throwaway and generated inboxes, one inbox under many names, many accounts from one address or device, SMS pumping on the verification text — protecting text messages |
| 020 | Account aggregation — a third party signing in for users | Partial | A non-browser client at a sign-in is seen as one, and a rule can let a named aggregator's network through; there is no catalogue of aggregators |
| 021 | Denial of inventory — carts filled and never paid | Covered | hold: units held from an address or a device and not bought, one item held again and again, one item held again as each hold lapses — protecting stock from being held |
Thirteen covered, eight partial. The partial ones are not claimed as coverage anywhere else in these docs.