🛡️ OWASP Top 10

1. Broken Access Control

Occurs when users can act outside their intended permissions (e.g., accessing other users' data via IDOR).

GET /api/user/12345 HTTP/1.1
Authorization: Bearer valid-token

➡️ Returns data of another user (no authorization check)

Mitigation: Enforce server-side access control checks. Never rely on client-side validation.

2. Cryptographic Failures

Insecure handling of sensitive data: weak encryption, missing HTTPS, or improper key storage.

Mitigation: Use TLS, strong algorithms (AES-256, SHA-256), and proper key management.

3. Injection

Attackers can send malicious data that gets executed (e.g., SQL, NoSQL, OS commands).

input: ' OR '1'='1
➡️ SELECT * FROM users WHERE username = '' OR '1'='1';

Mitigation: Use parameterized queries and ORM frameworks. Sanitize all input.

4. Insecure Design

Fundamental security flaws in the architecture itself (not just implementation bugs).

Mitigation: Use threat modeling, secure design patterns, and defense-in-depth strategies.

5. Security Misconfiguration

Default settings, overly verbose error messages, or unused features left enabled.

Example: Admin console exposed at /admin with default creds.

Mitigation: Harden servers, disable unused components, and monitor configs.

6. Vulnerable and Outdated Components

Using libraries or packages with known security flaws (e.g., Log4j, jQuery, OpenSSL bugs).

Mitigation: Use dependency scanners (e.g., Snyk, OWASP Dependency-Check). Update regularly.

7. Identification and Authentication Failures

Includes weak password policies, session hijacking, and flawed authentication logic.

Mitigation: Implement MFA, limit login attempts, and secure session tokens.

8. Software and Data Integrity Failures

Occurs when software relies on plugins, libraries, or updates from untrusted sources.

Mitigation: Use code signing, verify integrity of packages (hashes, checksums).

9. Security Logging and Monitoring Failures

Without proper logs and alerts, breaches may go undetected.

Mitigation: Enable security logs and integrate with SIEM tools. Monitor anomalies in real-time.

10. Server-Side Request Forgery (SSRF)

SSRF allows attackers to force the server to send requests on their behalf (e.g., internal networks).

URL: https://vulnerable.site/load?url=http://localhost:8000/admin

Mitigation: Validate and whitelist URLs, isolate internal services, and restrict outbound traffic.