OWASP TOP 10
WEB SECURITY.

What is the OWASP Top 10?

The Open Worldwide Application Security Project (OWASP) Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.

OWASP Top 10 (2021) – At a Glance

#	Risk	Key Impact
A01	Broken Access Control	Unauthorised data exposure / privilege escalation
A02	Cryptographic Failures	Sensitive data exposure (ex‑passwords, credit cards)
A03	Injection	SQL, NoSQL, OS, LDAP injection – data loss / RCE
A04	Insecure Design	Architectural flaws leading to broken controls
A05	Security Misconfiguration	Default passwords, open ports, verbose errors
A06	Vulnerable & Outdated Components	Known CVEs in libraries / frameworks
A07	Identification & Authentication Failures	Session hijacking, credential stuffing
A08	Software & Data Integrity Failures	Insecure deserialisation, CI/CD pipeline attacks
A09	Security Logging & Monitoring Failures	Delayed detection of breaches
A10	Server‑Side Request Forgery (SSRF)	Internal network scanning / cloud metadata abuse

---

A01 – Broken Access Control

Access control enforces policy such that users cannot act outside of their intended permissions.

Examples

• Modifying a URL parameter to view another user's account (/user/123 → /user/124)
• Bypassing admin panels via force browsing
• API endpoints without proper role checks

Prevention

• Implement deny‑by‑default access control policies.
• Use server‑side session data; never trust client‑side permission flags.
• Validate each request with proper role‑based or attribute‑based checks.
• Test access controls thoroughly with unit and integration tests.

---

A02 – Cryptographic Failures

Formerly "Sensitive Data Exposure". This covers failures related to cryptography that lead to exposure of sensitive data.

Examples

• Storing passwords in plaintext or using weak hashes (MD5, SHA1).
• Transmitting data over HTTP without TLS.
• Using deprecated ciphers or hard‑coded encryption keys.

Prevention

• Use strong, modern algorithms: AES‑256, Argon2 / bcrypt for passwords, TLS 1.3.
• Never roll your own crypto – use well‑vetted libraries.
• Encrypt data at rest and in transit; manage keys securely (e.g., HSM, key vaults).

---

A03 – Injection

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.

Examples

• SQL Injection: ' OR '1'='1 bypassing login.
• NoSQL Injection – manipulating MongoDB queries.
• OS Command Injection: ; rm -rf /

Prevention

• Use parameterised queries (prepared statements) for SQL.
• Use allow‑list validation for user input.
• Employ safe APIs that avoid interpreter context.
• Apply the principle of least privilege to database accounts.

// Safe (parameterised)
PREPARE stmt FROM 'SELECT * FROM users WHERE email = ?';
EXECUTE stmt USING user_email;

// UNSAFE (concatenation – DO NOT DO THIS)
query = "SELECT * FROM users WHERE email = '" + user_email + "'";

---

A04 – Insecure Design

Software designed with fundamental security flaws from the outset.

Examples

• Trusting client‑side validation only, without server‑side checks.
• Omitting rate‑limiting on authentication endpoints.
• Designing a system that relies on security through obscurity.

Prevention

• Embed threat modelling into your design phase.
• Adopt secure design patterns (e.g., zero‑trust, defence in depth).
• Perform architecture risk analysis before coding.

---

A05 – Security Misconfiguration

Insecure default configurations, incomplete setups, or verbose error messages.

Examples

• Leaving default admin credentials (admin/admin).
• Directory listing enabled on production.
• Out‑of‑the‑box settings with insecure defaults.

Prevention

• Harden your infrastructure using benchmarks (CIS, NIST).
• Remove unnecessary features, frameworks, and sample code.
• Automate configuration validation in CI/CD.
• Disable verbose error messages in production.

---

A06 – Vulnerable & Outdated Components

Using libraries, frameworks, or software with known vulnerabilities.

Examples

• Using Log4j versions prior to 2.17.0 (CVE‑2021‑44228).
• Relying on unsupported, unpatched open‑source packages.

Prevention

• Maintain an inventory of all dependencies.
• Use tools like OWASP Dependency‑Check, Snyk, or Dependabot.
• Regularly update and patch components – subscribe to CVEs.

---

A07 – Identification & Authentication Failures

Weak authentication mechanisms allow attackers to compromise user identities.

Examples

• Permitting brute‑force attacks with no rate‑limiting.
• Using weak, common passwords without MFA.
• Session IDs exposed in URLs or not rotated after login.

Prevention

• Enforce multi‑factor authentication (MFA).
• Implement rate‑limiting and account lockout policies.
• Use secure, HttpOnly, SameSite cookies for sessions.
• Re‑authenticate for sensitive operations (e.g., password changes).

---

A08 – Software & Data Integrity Failures

Failures related to software updates, CI/CD pipelines, and deserialisation.

Examples

• Insecure deserialisation of untrusted data (e.g., Java, Python pickle).
• Using unsigned or untrusted third‑party libraries.
• CI/CD pipelines with insufficient access controls.

Prevention

• Never deserialise from untrusted sources.
• Use digital signatures to verify artifact integrity.
• Secure your CI/CD pipeline with least‑privilege credentials.

---

A09 – Security Logging & Monitoring Failures

Without proper logging, breaches can go undetected for months.

Examples

• Not logging authentication failures or privilege escalations.
• Logs stored locally with no central aggregation or alerting.
• No incident response plan in place.

Prevention

• Log all critical events (logins, access denials, data modifications).
• Use a SIEM (Security Information and Event Management) system.
• Set up alerting for anomalous patterns.
• Test your detection capabilities regularly.

---

A10 – Server‑Side Request Forgery (SSRF)

An attacker can induce the server to make requests to unintended locations.

Examples

• Using a URL parameter to fetch internal resources: http://169.254.169.254/latest/meta-data/ (AWS metadata).
• Scanning internal networks behind a firewall.
• Accessing local files via file:///etc/passwd.

Prevention

• Strictly validate and sanitise user‑supplied URLs.
• Maintain an allow‑list of permitted domains / IPs.
• Run firewall rules to block outbound requests to sensitive internal IP ranges.

---

Essential Security Headers

Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin

Security Testing Tools

• Burp Suite – Web vulnerability scanner / proxy.
• OWASP ZAP – Open‑source penetration testing tool.
• Nmap – Network discovery and port scanning.
• SQLmap – Automated SQL injection detection.
• Nikto – Web server scanner.
• Dependency‑Check – SCA (Software Composition Analysis).

Secure Coding Best Practices (Checklist)

• Validate all input – client‑side is not enough.
• Use parameterised queries to prevent injection.
• Hash passwords with bcrypt / Argon2 (never MD5/SHA1).
• Enable HTTPS with HSTS.
• Implement proper session management (HttpOnly, Secure, SameSite).
• Use environment variables for secrets – never hard‑code.
• Apply the principle of least privilege for DB users and services.
• Keep dependencies updated via automated scanning.
• Log appropriately and set up monitoring alerts.
• Perform regular security training and threat modelling.