| name | owasp-cheatsheets |
| description | Comprehensive OWASP Cheat Sheet Series skill providing direct access to all OWASP cheat sheets for web application security, secure coding practices, and vulnerability prevention. Use when working on authentication, authorization, injection prevention, cryptography, or any OWASP-related security guidance. |
| license | CC-BY-SA-4.0 |
| metadata | {"author":"OWASP","version":"1.0","source":"https://github.com/OWASP/CheatSheetSeries","categories":"authentication, authorization, injection, xss, csrf, cryptography, security, owasp"} |
| compatibility | Works with any agent or LLM. No special tools required. Requires internet access to fetch remote cheat sheets. |
OWASP Cheat Sheet Series
This skill provides direct access to the OWASP Cheat Sheet Series, a collection of concise, actionable security guidance for developers, architects, and security professionals. All content is fetched from the official OWASP repository.
When to Use This Skill
Use this skill when:
- Developing secure web applications
- Reviewing code for security vulnerabilities
- Implementing authentication and authorization systems
- Preventing injection attacks (SQL, XSS, CSRF, etc.)
- Securing data storage and transmission
- Configuring secure infrastructure
- Working with emerging technologies (AI, cloud, containers, etc.)
- Following OWASP best practices
Quick Start
Most Common Security Tasks
Category Overview
The OWASP Cheat Sheet Series is organized into the following categories:
1. Authentication & Authorization
All aspects of user identity verification, access control, and session management.
Cheat Sheets:
2. Injection Prevention
Preventing all forms of injection attacks across different technologies.
Cheat Sheets:
3. Data Protection
Securing data at rest, in transit, and during processing.
Cheat Sheets:
4. Application Security
General application security principles and practices.
Cheat Sheets:
5. Infrastructure & Deployment Security
Securing the infrastructure and deployment pipeline.
Cheat Sheets:
6. Framework & Language-Specific
Security guidance for specific frameworks and languages.
Cheat Sheets:
7. Emerging Technologies
Security for modern and emerging technologies.
Cheat Sheets:
8. Specialized Topics
Niche but important security areas.
Cheat Sheets:
How to Use This Skill
For Developers
- Identify the security concern (e.g., "I need to prevent SQL injection")
- Navigate to the relevant category (Injection Prevention)
- Click the specific cheat sheet link (SQL Injection Prevention)
- Follow the actionable guidance provided in the official OWASP documentation
For Security Reviewers
- Use the Attack Surface Analysis Cheat Sheet to identify potential vulnerabilities
- Cross-reference with relevant prevention cheat sheets
- Apply the Secure Code Review Cheat Sheet principles
- Document findings using the Logging Cheat Sheet guidance
For Architects
- Start with Secure Product Design Cheat Sheet
- Apply Secure Cloud Architecture principles
- Use Microservices Security Cheat Sheet for distributed systems
- Implement Infrastructure as Code Security best practices
Common Security Patterns
Authentication Flow
1. User provides credentials (username/password)
2. Validate input (Input Validation Cheat Sheet)
3. Verify password securely (Password Storage Cheat Sheet)
4. Create session (Session Management Cheat Sheet)
5. Set secure cookies (Cookie Theft Mitigation Cheat Sheet)
6. Implement MFA if required (Multifactor Authentication Cheat Sheet)
Secure Data Access
1. Receive user input
2. Validate all input (Input Validation Cheat Sheet)
3. Use parameterized queries (SQL Injection Prevention Cheat Sheet)
4. Encode output (XSS Prevention Cheat Sheet)
5. Log access appropriately (Logging Cheat Sheet)
API Security Checklist
OWASP Top 10 Mapping
The cheat sheets align with the OWASP Top 10 vulnerabilities:
| OWASP Top 10 | Relevant Cheat Sheets |
|---|
| A01:2021 - Broken Access Control | Access Control, Authorization, Insecure Direct Object Reference Prevention |
| A02:2021 - Cryptographic Failures | Cryptographic Storage, Password Storage, TLS Cipher String |
| A03:2021 - Injection | SQL Injection Prevention, XSS Prevention, OS Command Injection, LDAP Injection, Deserialization |
| A04:2021 - Insecure Design | Secure Product Design, Business Logic Security, Attack Surface Analysis |
| A05:2021 - Security Misconfiguration | HTTP Headers, Content Security Policy, Secure Cloud Architecture |
| A06:2021 - Vulnerable and Outdated Components | Dependency Graph SBOM, Software Supply Chain Security |
| A07:2021 - Identification and Authentication Failures | Authentication, Password Storage, Session Management, Multifactor Authentication |
| A08:2021 - Software and Data Integrity Failures | Input Validation, File Upload, Deserialization |
| A09:2021 - Security Logging and Monitoring Failures | Logging, Logging Vocabulary |
| A10:2021 - Server-Side Request Forgery | SSRF Prevention |
Best Practices Summary
Always Do
- Use parameterized queries for all database access
- Validate all input on the server side
- Encode all output based on context
- Store passwords using strong hashing (bcrypt, Argon2, PBKDF2)
- Use HTTPS for all communications
- Implement proper session management
- Apply the principle of least privilege
- Log security-relevant events
Never Do
- Use string concatenation for SQL queries
- Store passwords in plaintext or using weak hashing (MD5, SHA1)
- Trust client-side validation alone
- Expose sensitive information in error messages
- Use predictable session IDs
- Disable security headers
- Ignore security in the design phase
Complete Cheat Sheet Index
For a complete, searchable list of all cheat sheets, visit:
Original Source
All content is sourced from the OWASP Cheat Sheet Series repository, licensed under CC-BY-SA-4.0.
For the most up-to-date information, always refer to the official OWASP repository.
