What Is OWASP?
OWASP (Open Web Application Security Project) is a nonprofit foundation that works to improve software security. Their "Top 10" list is the most widely recognized document on web application security risks.
The OWASP Top 10 is updated every few years based on data from hundreds of organizations and thousands of real-world applications. If you run a website, understanding these 10 risks is essential.
The OWASP Top 10 (Current Edition)
1. Broken Access Control
What it is: Users can access data or perform actions they should not be authorized to do.
Real example: A regular user changes the URL from /account/123 to /account/456 and can see another user's data. Or a non-admin user accesses /admin because the server only hides the link but does not check permissions.
How to fix it: - Always check permissions on the server side, not just in the UI - Deny access by default (whitelist approach) - Use role-based access control (RBAC) - Log access control failures and alert on repeated attempts
2. Cryptographic Failures
What it is: Sensitive data is exposed because of weak or missing encryption.
Real example: A website stores passwords in plain text, transmits credit card numbers over HTTP, or uses outdated hashing algorithms like MD5.
How to fix it: - Use HTTPS everywhere (TLS 1.2+) - Hash passwords with bcrypt or argon2 - Encrypt sensitive data at rest - Never store sensitive data you do not need
3. Injection
What it is: Untrusted data is sent to an interpreter as part of a command or query. The most common form is SQL injection.
Real example: An attacker types '; DROP TABLE users; -- into a search field, and the database executes it because the input is not sanitized.
How to fix it: - Use parameterized queries / prepared statements (never concatenate user input into SQL) - Use an ORM (Object-Relational Mapping) - Validate and sanitize all user inputs - Apply the principle of least privilege to database accounts
4. Insecure Design
What it is: The application's architecture has fundamental security flaws that cannot be fixed by implementation alone.
Real example: A password reset flow that sends the actual password via email instead of a one-time reset link. Or a "security question" that asks for publicly available information.
How to fix it: - Threat model during design phase - Use secure design patterns and reference architectures - Create abuse cases alongside use cases - Get security reviews before building
5. Security Misconfiguration
What it is: The application or server is configured with insecure default settings, incomplete configurations, or unnecessary features enabled.
Real example: Default admin credentials left unchanged, directory listing enabled, stack traces shown to users in error pages, unnecessary HTTP methods enabled.
How to fix it: - Remove default accounts and passwords - Disable directory listing - Show generic error pages (never stack traces) - Remove unnecessary features, frameworks, and components - Automate configuration verification with security scanners
6. Vulnerable and Outdated Components
What it is: Using libraries, frameworks, or software with known vulnerabilities.
Real example: Running WordPress 4.x with a known remote code execution vulnerability, or using an npm package with a published CVE.
How to fix it:
- Keep all components updated
- Remove unused dependencies
- Run npm audit, pip audit, or equivalent regularly
- Subscribe to security advisories for your tech stack
- Use automated dependency scanning in CI/CD
7. Identification and Authentication Failures
What it is: Weaknesses in how users prove who they are.
Real example: Allowing weak passwords like "123456", not implementing rate limiting on login attempts, not supporting multi-factor authentication, or storing session IDs in URLs.
How to fix it: - Enforce strong password policies - Implement multi-factor authentication (MFA) - Rate-limit login attempts - Use secure session management - Never expose session tokens in URLs
8. Software and Data Integrity Failures
What it is: Code or infrastructure that does not verify the integrity of updates, data, or CI/CD pipelines.
Real example: An application auto-updates without verifying the update's digital signature. Or a CI/CD pipeline pulls dependencies without integrity checks, allowing a supply chain attack.
How to fix it: - Verify digital signatures on updates and packages - Use lock files and integrity hashes for dependencies - Secure your CI/CD pipeline - Review code before merging
9. Security Logging and Monitoring Failures
What it is: Not detecting, logging, or alerting on security events.
Real example: An attacker brute-forces login attempts for weeks, but nobody notices because there are no alerts on failed logins. Or a data breach occurs and there are no logs to investigate what happened.
How to fix it: - Log all authentication attempts (success and failure) - Log access control failures - Set up alerts for suspicious patterns - Store logs securely and retain them long enough for investigation - Test your incident response process
10. Server-Side Request Forgery (SSRF)
What it is: The application fetches a remote resource based on user input without validating the destination.
Real example: A URL preview feature that an attacker abuses to access internal services: https://yourapp.com/preview?url=http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint).
How to fix it: - Validate and sanitize all URLs provided by users - Block requests to internal/private IP ranges - Use allowlists for permitted domains - Do not send raw server responses back to users
How to Test for OWASP Top 10
You do not need to be a penetration tester to check for these vulnerabilities:
- 1Run a security scan — ZeriFlow checks for many OWASP-related issues including security headers, SSL configuration, and common misconfigurations
- 2Review your code — Use static analysis tools (SonarQube, Semgrep)
- 3Check dependencies — Run
npm audit,pip audit, or use Snyk - 4Test authentication — Try common attack scenarios manually
Conclusion
The OWASP Top 10 covers the most critical risks, but you do not need to fix everything at once. Start with the basics: update your software, use HTTPS, set security headers, and validate all user input. Then use automated scanning with ZeriFlow to continuously monitor for new issues.
Security is a journey, not a destination.