Service Abuse Service abuse uses legitimate functions of a system in an unforeseen way. The attacker does not have to find a classic vulnerability. It is enough to work out h …

API Abuse API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a te …

Contractor Abuse Contractor access abuse arises when a consultant, a contractor, an external firm or a temporarily engaged person uses access more widely or for longer than the …

Shared Account Abuse Shared account abuse begins wherever several people use the same username and password. The system then no longer knows who actually did something. It knows onl …

Privilege Misuse Privilege misuse arises when somebody uses rights they genuinely hold for actions they have no business reason to take. Unlike privilege escalation, the attacker or insider here does not have to acquire new authority. The trouble is that the existing authority is enough to do damage.

Credential stuffing … and their private accounts. For the attacker, the abuse can begin.

Pass-the-Hash … prove identity; the hash is enough. Pass-the-hash abuses exactly that: if the attacker obtains a user's hash, they can log in with it without ever learning the …

Resource Exhaustion … off slow operations and no protection against the abuse of expensive functions, the attacker uses a perfectly regular mechanism to cause a problem.

Spyware … m shows up in corporate espionage and in domestic abuse.

voice phishing - Vishing … one-time code from an SMS, supposedly to stop the abuse.