OWASP Top 10 & Web Vulnerabilities

🏆 OWASP Top 10 Overview

OWASP (Open Web Application Security Project) is a nonprofit foundation producing free, open security resources. The OWASP Top 10 — last updated in 2021 — is the de facto standard for web application security awareness, used as a baseline in compliance frameworks (PCI DSS, SOC 2) and security programs worldwide.

⚡ Injection & Broken Authentication

# SQL Injection payloads
' OR '1'='1                    # Boolean bypass
' UNION SELECT null,username,password FROM users--   # Union-based data extraction
'; WAITFOR DELAY '0:0:5'--     # Time-based (MSSQL)
' AND SLEEP(5)--               # Time-based (MySQL)

# Fix: Parameterized query (Python)
cursor.execute("SELECT * FROM users WHERE username = %s AND password_hash = %s",
               (username, password_hash))

# Fix: Stored procedure (SQL Server)
EXEC sp_GetUser @username = @input_username

🔒 Cryptographic & Access Control Failures

# IDOR Example — insecure
# GET /api/invoices/1042 returns invoice for user A
# Attacker (user B) changes ID:
# GET /api/invoices/1043  -- returns user A's invoice

# IDOR Fix — always verify ownership server-side
def get_invoice(invoice_id, requesting_user_id):
    invoice = db.query("SELECT * FROM invoices WHERE id = ?", invoice_id)
    if invoice.owner_id != requesting_user_id:
        raise ForbiddenError("Access denied")  # 403, not 404
    return invoice

# CORS misconfiguration — insecure
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true   # INVALID combination — browsers ignore, but still a signal

# CORS fix — explicitly allowlist origins
allowed_origins = ["https://app.example.com", "https://admin.example.com"]
if request.origin in allowed_origins:
    response.headers["Access-Control-Allow-Origin"] = request.origin

🌐 SSRF, XXE & Security Misconfigurations

🚫 Vulnerable Components & Logging Failures