Practical Web Penetration Testing

Tampering – integrity

Threat Description	Threat action that mainly aims to alter the data at rest or in transit.
Threat Target	The site data.
Attacker Steps	An attacker can do the following for this type of threat: Can manipulate data through an SQL injection Attack / XSS Attack An internal attacker can manipulate data by accessing the database directly without having the right privilege An attacker can intercept the communication and alter it
Counter-Measure	The admin console for WordPress is only accessible through the intranet The database will not be accessible directly by a DB admin (only accessible through WordPress) Communication is only accessible through TLS
Existing Counter-Measure	N/A - it's a ...