Web Application Attacks: XSS, SSRF, IDOR, Deserialization, and Web Shell Incident Response
NIST SP 800-61–compliant incident response playbook for XSS, SSRF, IDOR, insecure deserialization, and web shell incidents triggered by WAF/application log alerts.
- For XSS: CSP and output encoding
- For SSRF: egress filtering and metadata endpoint restriction
- For IDOR: object-level authorization (OWASP API3:2023)
- For Deserialization: signed input validation
Prepare
7 steps- Log infrastructure
Web server access logs (minimum 90-day retention) and WAF/IDS logs must stream to a centralized SIEM; egress proxy logs must be accessible
- WAF activity
WAF must operate in both detection and blocking mode; OWASP CRS XSS (941xxx), SSRF/LFI (931xxx), and deserialization signatures must be in production
- Application audit log
An application-layer audit log recording who accessed what on each object access must be active; without this, IDOR detection is practically impossible
- Source code access
AppSec team access to commit history and SAST tool (Semgrep/CodeQL) must be defined; dependency security scanning (OWASP Dependency-Check) must be active in the CI/CD pipeline
- Data inventory
The endpoint and database where personal data assets within scope of KVKK/GDPR are processed must be documented
- Authority definition
SOC authority to add WAF rules, isolate endpoints, and temporarily shut down applications must be pre-defined and tested