OWASP - IAS

OWASP

It is a nonprofit foundation that works to improve the security of software.

Open Worldwide Application Security Project

Acronym of OWASP

2001

What year was OWASP found?

Community-Driven

Anyone can contribute, and most resources are free and open source.

OWASP Top 10

The most critical web application security risks.

Application Security Verification Standard

Acronym of OWASP - ASVS?

OWASP ZAP

A free web app security scanner.

1. A baseline for secure coding standards

2. A checklist for secuirty audits and penetration tests

3. A teaching tool for developers new to application security

The OWASP Top 10 is a regularly updated report outlining the 10 most critical security risks to web applications,

based on large-scale data analysis and expert consensus. It's used worldwide as:

Broken Access Control

Users can act outside their intended permissions — viewing, modifying, or deleting data they shouldn't

have access to.

Broken Access Control

An online banking app lets a logged-in user view their account statement at

https://bank.com/statements?user_id=1024. A curious (or malicious) user changes the URL to user_id=1025

and — because the server never checks whether the requester actually owns that account — sees another

customer's private statement.

Defense:

Enforce server-side authorization

Cryptographic Failures

Sensitive data (passwords, credit cards, health records) is exposed due to weak, missing, or misused

encryption.

Cryptographic Failures

An e-commerce site stores customer passwords using plain MD5 hashing with no salt. When

attackers breach the database, they crack most passwords within hours using rainbow tables, and then reuse

those credentials to break into users' email and social media accounts (credential stuffing).

Defense:

Strong Encyption and Hashing

Injection

Untrusted input is interpreted as executable code or commands (SQL, NoSQL, OS commands, LDAP).

Injection

A login form builds a SQL query like: SELECT * FROM users WHERE username = ' + input + '

AND password = '...'. An attacker types admin' -- into the username field. The query becomes valid SQL that

ignores the password check entirely, logging the attacker in as admin — this is classic SQL Injection.

Defense:

Parameterized queries

Insecure Design

Security flaws baked into the architecture itself — not a bug, but a missing security control by design.

Insecure Design

A password-reset feature emails a 4-digit numeric code with no rate limiting. Since there are only 10,000 possible codes, an attacker can script repeated guesses and take over any account in minutes — the flaw exists even though the code was implemented "correctly."

Defense:

Threat model early

Security Misconfiguration

Insecure default settings, unnecessary features enabled, verbose error messages, or unpatched systems.

Security Misconfiguration

Scenario: A company deploys a cloud storage bucket to host user-uploaded files but forgets to disable public listing. Anyone who finds the bucket URL can browse and download every file — including private ID scans — because the default "public read" setting was never turned off.

Defense:

Harden configurations

Vulnerable and Outdated Components

Using libraries, frameworks, or plugins with known vulnerabilities.

Vulnerable and Outdated Components

A company's website runs a 3-year-old version of a popular JavaScript library with a publicly known

cross-site scripting (XSS) vulnerability (there's even a public CVE and exploit code). Attackers scan the internet for sites still using that version and compromise them automatically — no custom hacking required.

Defense:

Patch and Scan Dependencies

Identificqation and Authentication Failures

Weaknesses in login, session management, or identity verification.

Identification and Authentication Failures

A web app allows unlimited login attempts with no lockout or CAPTCHA. An attacker runs a brute-force or credential-stuffing attack using a list of leaked passwords from other breaches, and successfully logs into hundreds of accounts that reused passwords.

Defense:

MFA + Lockouts

Software and Data Integrity Failures

Code or infrastructure that doesn't verify the integrity of updates, plugins, or CI/CD pipelines, allowing

untrusted code to run.

Software and Data Integrity Failures

A company's CI/CD pipeline auto-installs dependencies from a public package repository without

checksum verification. An attacker publishes a malicious package with a name nearly identical to a popular one

(typosquatting). A developer's build script accidentally pulls the fake package, and malicious code gets shipped straight into production — this is essentially how real-world supply-chain attacks (e.g., the SolarWinds incident) happen.

Defense:

Verify signatures, pin dependencies

Security Logging and Monitoring Failures

Insufficient logging, monitoring, or alerting lets attacks go undetected.

Security Logging and Monitoring Failures

An attacker slowly exfiltrates a company's customer database over three weeks, a little at a time, to avoid triggering any alarms. The company only discovers the breach six months later — when the stolen data appears for sale on a dark web forum — because no one was monitoring for unusual data access patterns.

Defense:

Centralize logging & alerts

Server-Side Request Forgery (SSRF)

An application fetches a remote resource based on user-supplied input without validating the destination, letting attackers make the server issue requests on their behalf.

Server Side Request Forgery (SSRF)

A web app has an "import profile picture from URL" feature. An attacker submits a URL pointing to the cloud provider's internal metadata endpoint (http://169.254.169.254/...) instead of an image. The server obligingly fetches it — and leaks internal cloud credentials that should never have been reachable from outside.

Defense:

Validate and Allow - list destinations

A01 - Broken Access Control

A02 - Cryptographic Failures

A03 - Injection

A04 - Insecure Design

A05 - Security Misconfiguration

A06 - Vulnerable and Outdated Components

A07 - Identification and Authentication Failures

A08 - Software and Data Integrity Failures

A09 - Security Logging and Monitoring Failures

A10 - Server Side Request Forgery (SSRF)

What are the 10 OWASP Categories: