Owasp Top 10

OWASP Top 10 Security Vulnerabilities

Expert guidance for identifying, preventing, and remediating the most critical web application security risks based on OWASP Top 10 2021.

When to Use This Skill

• Conducting security audits and code reviews
• Implementing secure coding practices in new features
• Reviewing authentication and authorization systems
• Assessing input validation and sanitization
• Evaluating third-party dependencies for vulnerabilities
• Designing security controls and defense-in-depth strategies
• Preparing for security certifications or compliance audits
• Investigating security incidents or suspicious behavior

OWASP Top 10 2021 Overview

Ranked by Risk Severity:

1. A01 - Broken Access Control (↑ from #5)
2. A02 - Cryptographic Failures (formerly Sensitive Data Exposure)
3. A03 - Injection (↓ from #1)
4. A04 - Insecure Design (NEW)
5. A05 - Security Misconfiguration
6. A06 - Vulnerable and Outdated Components
7. A07 - Identification and Authentication Failures
8. A08 - Software and Data Integrity Failures (NEW)
9. A09 - Security Logging and Monitoring Failures
10. A10 - Server-Side Request Forgery (SSRF) (NEW)

Quick Reference

Load detailed guidance for each vulnerability:

Security Audit Workflow

1. Identify Scope: Determine application components and attack surface
2. Select Vulnerabilities: Choose relevant OWASP categories based on features
3. Load Reference: Read appropriate reference file(s) for detailed patterns
4. Analyze Code: Review code against vulnerable and secure patterns
5. Document Findings: Record vulnerabilities with severity and remediation
6. Verify Fixes: Test that remediations properly address issues
7. Test Security: Run automated security testing (SAST, DAST, SCA)

Core Security Principles

Defense in Depth

• Layer security controls at network, application, data, and monitoring levels
• Ensure failure of one control doesn't compromise entire system

Secure by Default

• Deny all access by default, explicitly grant permissions
• Fail securely (errors don't expose sensitive information)
• Minimize attack surface (disable unused features)
• Apply least privilege to all accounts and services

Input Validation

• Validate type, length, format, and allowed values
• Use allow-lists over deny-lists
• Sanitize for specific context (SQL, HTML, shell, etc.)
• Never trust client input

Common Mistakes

1. Trusting User Input: Always validate and sanitize all user-supplied data
2. Rolling Your Own Crypto: Use established libraries (bcrypt, AES-256)
3. Exposing Errors: Log detailed errors internally, show generic messages to users
4. Missing Authorization: Check permissions on every request, not just UI
5. Weak Session Management: Use secure, httpOnly, sameSite cookies with HTTPS
6. Ignoring Dependencies: Regularly audit and update third-party libraries
7. No Logging: Log security events for detection and incident response
8. Default Configurations: Harden all systems, disable defaults

Security Testing Tools

SAST (Static): SonarQube, Semgrep, ESLint security plugins DAST (Dynamic): OWASP ZAP, Burp Suite SCA (Dependencies): npm audit, Snyk, Dependabot Secrets Scanning: GitGuardian, TruffleHog Penetration Testing: Metasploit, Kali Linux tools

Resources

• OWASP Top 10 2021: https://owasp.org/Top10/
• OWASP Cheat Sheets: https://cheatsheetseries.owasp.org/
• OWASP ASVS: Application Security Verification Standard
• CWE Top 25: Common Weakness Enumeration
• NIST Cybersecurity Framework: https://www.nist.gov/cyberframework
• CVE Database: https://cve.mitre.org/
• Snyk Vulnerability DB: https://snyk.io/vuln/