The OWASP Top 10 provides a powerful awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications. While the specific entries shift over time, the underlying principles remain crucial for anyone involved in building, testing, or defending web applications.
A01: Broken Access Control
Description: Flaws in how an application enforces permissions, allowing unauthorized users to access, view, or modify data or perform actions they shouldn’t.
Impact: Unauthorized information disclosure, data manipulation, privilege escalation, and full account compromise.
Example: Changing /profile?id=123 to /profile?id=124 to view another user’s private data (IDOR).
Mitigation: Implement strict access control checks on the server-side for every request accessing resources or performing actions. Adopt a deny-by-default policy.
A02: Cryptographic Failures
Description: Pertains to cryptographic implementation issues that lead to sensitive data exposure or system compromise. This is the new name for “Sensitive Data Exposure”.
Impact: Disclosure of sensitive data (PII, financial data, credentials), session hijacking, data tampering.
Example: Using weak or deprecated encryption algorithms, incorrect key management, storing sensitive data without encryption, or transmitting data over unencrypted channels.
Mitigation: Strong, up-to-date cryptographic protocols (TLS 1.2+), secure key management, encrypting sensitive data at rest and in transit, hashing passwords securely (e.g., bcrypt).
WEBWant to practise this hands-on? Certified VAPT Web Exploitation covers it with live labs and mentor support.A03: Injection
Description: When untrusted data is sent to an interpreter as part of a command or query, tricking the interpreter into executing unintended commands or accessing unauthorized data.
Impact: Data loss, data corruption, denial of service, full host takeover.
Example: SQL Injection, NoSQL Injection, OS Command Injection, LDAP Injection.
Mitigation: Use parameterized queries (prepared statements), input validation, escaping all special characters, and least privilege for database accounts.
A04: Insecure Design
Description: A new category that focuses on risks related to design and architectural flaws. It emphasizes the need for threat modeling, secure design patterns, and reference architectures.
Impact: Leads to a variety of security weaknesses that can be exploited for significant impact.
Example: Lack of proper separation of duties, insufficient logging for critical events, failing to implement “fail-safe” mechanisms, or designs that implicitly trust client-side input.
Mitigation: Implement threat modeling during design, use secure design patterns, establish a secure development lifecycle (SDL), and engage security professionals early in the design process.
A05: Security Misconfiguration
Description: Results from insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information.
Impact: System access, information disclosure, data modification.
Example: Default accounts with weak passwords, open S3 buckets, unnecessary services enabled, unpatched security flaws, allowing directory listing.
Mitigation: Implement a hardened installation process, automate configuration management, remove unused features, send security headers, and keep all components patched.
A06: Vulnerable and Outdated Components
Description: Using components (libraries, frameworks, and other software modules) with known vulnerabilities. This includes client-side JavaScript libraries and server-side components.
Impact: Varies depending on the component’s vulnerability, from information disclosure to full system control.
Example: Using an old version of Apache Struts, vulnerable JavaScript libraries (e.g., jQuery), or outdated operating system packages.
Mitigation: Regularly update all components, remove unused dependencies, use Software Composition Analysis (SCA) tools, and monitor CVE databases.
A07: Identification and Authentication Failures
Description: Flaws related to user authentication, including managing user credentials, session management, and protecting user identities.
Impact: Account compromise, impersonation, session hijacking.
Example: Weak password policies, insecure session management (predictable session IDs), insufficient multi-factor authentication (MFA), allowing default or weak credentials.
Mitigation: Implement strong password policies, robust MFA, secure session management, rate limiting for login attempts, and proper credential storage.
A08: Software and Data Integrity Failures
Description: A new category that focuses on risks related to unchecked updates, critical data, and CI/CD pipelines. It assumes that data and software updates are handled without proper integrity verification.
Impact: Execution of malicious code, unauthorized data manipulation, system compromise.
Example: Not verifying signatures of software updates, relying on untrusted serialization/deserialization, or allowing client-side control over critical input parameters that affect data integrity.
Mitigation: Implement integrity checks for software updates and critical data, use secure deserialization mechanisms, and ensure all CI/CD pipeline steps are secured and verified.
A09: Security Logging and Monitoring Failures
Description: Insufficient logging and monitoring, leading to delayed detection, incomplete audits, and difficulties in forensic analysis. This is critical for post-incident recovery.
Impact: Undetected attacks, prolonged compromise, inability to investigate incidents effectively.
Example: Not logging login attempts, access failures, data modifications, or administrative actions; lacking alert mechanisms for suspicious activities.
Mitigation: Implement comprehensive logging for all security-relevant events, centralize logs, use Security Information and Event Management (SIEM) systems, and establish alerting for anomalies.
A10: Server-Side Request Forgery (SSRF)
Description: When a web application fetches a remote resource without validating the user-supplied URL. This allows an attacker to coerce the application to send a crafted request to an unintended destination.
Impact: Information disclosure from internal systems, access to metadata services in cloud environments, internal network port scanning, and potentially RCE.
Example: A web hook that takes a URL as input and fetches its content, but fails to restrict the URL to external, public resources. An attacker could use it to query http://localhost/admin or http://169.254.169.254/latest/meta-data/.
Mitigation: Whitelist allowed URLs/domains, validate and sanitize user-supplied URLs rigorously, use an allow-by-default policy for known safe protocols (HTTP/HTTPS), and implement network segmentation to restrict outgoing connections.
How to Use OWASP Top 10 Practically
- For Developers: Use it as a guide during design, coding, and testing to prevent common vulnerabilities.
- For Testers: Use it as a checklist to ensure all critical areas are covered during penetration testing and bug bounty hunting.
- For Management: Use it to understand the risks and prioritize security investments.
- For Everyone: It’s a foundational document for security awareness and training.
Certified VAPT Web Exploitation
Black box and grey box testing of modern web apps, from injection to access control flaws.