[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-572235-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-572235-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","owasp-automated-threat-handbook-web-applications-version-12","OWASP Automated Threat Handbook - Web Applications - Version 1.2","","OWASP Automated Threat Handbook for web applications delivers actionable guidance, terminology, and reference material for recognizing and mitigating automated threats. It defines an ontology and links threat events through structured classifications, including mappings shown in multiple figures. The handbook describes automated threat countermeasure classes, presents use-case scenarios, and provides an event reference for threat identification. Version 1.2 adds renamed and new threat events while updating reviewers, countermeasure text, examples, and editorial corrections.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/owasp-automated-threat-handbook-web-applications-version-12/572235/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/owasp-automated-threat-handbook-web-applications-version-12/572235.png","ImageObject",442,249,{"name":42,"@type":43},"Jasmine","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-23","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",7,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What does the OWASP Automated Threat Handbook aim to provide for web applications?","Question",{"text":63,"@type":64},"It provides actionable information and resources to help defend against automated threats to web applications, including structured threat event reference and supporting material.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What changed in version 1.2 of the handbook?",{"text":68,"@type":64},"Version 1.2 renames the threat event OAT-009 from CAPTCHA Bypass to CAPTCHA Defeat and adds a new threat event OAT-021 Denial of Inventory, along with updated content and editorial corrections.",{"name":70,"@type":61,"acceptedAnswer":71},"Why was the label CAPTCHA Bypass changed to CAPTCHA Defeat?",{"text":72,"@type":64},"Feedback indicates it is confusing because the CAPTCHA is not actually bypassed; it is solved in an automated manner because the CAPTCHA is simply not effective against motivated attackers.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},572235,1792087492,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,119,124],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},18,"Letters",30,"letters",{"id":120,"doc_module":22,"doc_module_name":25,"category_name":121,"show_sort_weight":122,"slug":123},21,"Paper Templates",5,"papers-templates",{"id":125,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":126},158,"general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":125,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":92,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":141},2336478487870,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","OWASP  \nAutomated Threat Handbook  \nWeb Applications  \nVersion 1.2  \nOWASP Automated Threat Handbook Web Applications  \n.............................................................  \n..............................................................  \nOpen Web Application Security Project  \nOWASP  \nAutomated Threat Handbook  \nWeb Applications  \nThe OWASP Automated Threat Handbook provides actionable information and resources to help defend against automated threats to web applications  \nAuthors  \nColin Watson and Tin Zaw  \nProject Reviewers  \nIgor Andriushchenko, Gabriel Mendez Justiniano and Matt Tesauro  \nOther Project Contributors  \nJason Chan, Mark Hall, Andrew van der Stock and Roland Weber, everyone else who contributed information anonymously, and the authors of the referenced information sources; v1.2: Sumit Agarwal and Omri Iluz  \nVersion 1.2 published 15th February 2018 ISBN 978-1-329-42709-9  \n© 2015-2018 OWASP Foundation  \nThis document is licensed under the Creative Commons Attribution-ShareAlike 3.0 license  \nOWASP Automated Threat Handbook Web Applications  \n.............................................................  \n..............................................................  \nOpen Web Application Security Project  \nContents  \n..............................................................  \nPrefaces .................................................... 1  \nTerminology ................................................ 4  \nIntroduction ................................................ 5  \nResearch.................................................... 7  \nThe Ontology ............................................... 9  \nFigure 1: Threat Events, ordered by ascending name ........................10  \nFigure 2: Subset related to Account Credentials ............................ 11  \nFigure 3: Subset related to Payment Cardholder Data ....................... 11  \nFigure 4: Subset related to Vulnerability Identification ...................... 11  \nFigure 5: Subset related to Availability of Inventory ......................... 11  \nFigure 6: WASC Threat Classification view of the Threat Events ...............12  \nFigure 7: Mitre CAPEC view of the Threat Events ............................13  \nCountermeasures .......................................... 19  \nFigure 8: Automated Threat Countermeasure Classes .......................20  \nUse Case Scenarios ......................................... 23  \nProject Details.............................................. 26  \nHandbook Roadmap ....................................... 27  \nAutomated Threat Event Reference .......................... 28  \n.............................................................  \nOWASP Automated Threat Handbook Web Applications  \n.............................................................  \n..............................................................  \nOpen Web Application Security Project  \nPreface to v1.2  \nFrom its original release in 2015, the OWASP Automated Threat Handbook has now become ade facto industry standard in detecting and mitigating threats by malicious web automation. Every bot mitigation vendor and many buyers of these services now use the ontology defined in this handbook. In this new version of the OWASP Automated Threat Handbook , the previously named automated threat event OAT-009 CAPTCHA Bypass has been renamed OAT-009 CAPTCHA Defeat, and a new threat event OAT-021 Denial of Inventory has been added.  \nCAPTCHA Bypass was originally used for OAT-009 since this is by far the most common name used. However, subsequent feedback suggests this is confusing, since the puzzle is not actually bypassed, but is solved in an automated manner – not because the CAPTCHA was implemented improperly, but because the CAPTCHA itself is simply not effective against motivated attackers. The name CAPTCHA Defeat has therefore been adopted.  \nDenial of Inventory has been added since its defining characteristics do not match any of the 20 previously de","cbCaigkMK6X3PZYb","https://ap.wps.com/l/cbCaigkMK6X3PZYb","pdf",1720926,"English","# Prefaces\n## Preface to v1.2\n## Preface to v1.1\n## Preface to v1.0\n# Terminology\n# Introduction\n# Research\n# The Ontology\n## Countermeasures\n# Use Case Scenarios\n# Project Details\n# Handbook Roadmap\n# Automated Threat Event Reference","[{\"question\":\"What does the OWASP Automated Threat Handbook aim to provide for web applications?\",\"answer\":\"It provides actionable information and resources to help defend against automated threats to web applications, including structured threat event reference and supporting material.\"},{\"question\":\"What changed in version 1.2 of the handbook?\",\"answer\":\"Version 1.2 renames the threat event OAT-009 from CAPTCHA Bypass to CAPTCHA Defeat and adds a new threat event OAT-021 Denial of Inventory, along with updated content and editorial corrections.\"},{\"question\":\"Why was the label CAPTCHA Bypass changed to CAPTCHA Defeat?\",\"answer\":\"Feedback indicates it is confusing because the CAPTCHA is not actually bypassed; it is solved in an automated manner because the CAPTCHA is simply not effective against motivated attackers.\"}]","OWASP Automated Threat Handbook - Web Applications - Version 1.2 | PDF",1791926290,28]