As a web security analyst, if you defend web applications or as a developer, you seek to adhere to SDLC practices, you must have referenced to the OWASP Top 10. Top 10 is covered with the most critical web application security flaws by global application security experts.

OWASP basically stands for Open Web Application Security Project. It is a not for profit global online community which consists of more than ten thousand members and hundreds of chapters that produce articles, tools, documentation and technologies in context of web application security. 

In each three to four years, OWASP publishes its list of the top 10 critical web application vulnerabilities. The list contains the potential impact of each vulnerability and how to prevent them. OWASP Top 10 promotes managing risk through an application risk management program, along with awareness training, application testing, and its remedy. 

The OWASP top 10 vulnerabilities are:

1. Injection Attacks
2. Identification and Authentication Failures
3. Cryptographic Failures (Sensitive Data Exposure)
4. Software and Data Integrity Failures
5. Broken Access Control
6. Security Misconfiguration
7. Server-Side Request Forgery (SSRF)
8. Insecure Design
9. Vulnerable and Outdated Components
10. Security Logging and Monitoring Failures

1. Injection Attacks

The vulnerabilities regarding injection take place when an attacker uses a query or command to insert untrusted data into the interpreter through SQL, OS, NoSQL, or LDAP injection. The data that is injected via the attack vector makes the application do something it is not designed for. Not all the applications are vulnerable to this attack, only the applications which accept parameters as input are vulnerable to injection attacks.

How can you prevent Injection attacks?

Injection attacks can be prevented by 

• Using parameterized queries when coding
• Using safe API which can avoid the use of the interpreter
• Differentiating commands from data to avoid exposure to attacks

2. Identification and Authentication Failures

When an attacker uses manual or automatic methods to gain control over any account, the vulnerability is considered  as broken authentication. They can even get complete control over the systems in some cases. This vulnerability is dangerous because websites with broken authentication vulnerabilities are very common on the web. When applications incorrectly execute functions related to session management, broken authentication occurs in such situations. The intruders can compromise passwords, security keys, or session keys.

How can you prevent Identification and Authentication Failures?

Identification and authentication failures can be prevented by

• Protecting user credentials
• Implementing multi-factor authentication
• Sending passwords over encrypted connections

3. Cryptographic Failures (Sensitive Data Exposure)

Sensitive Data Exposure is a very widespread vulnerability on the OWASP list. It occurs when applications and APIs don’t protect the sensitive data properly. Sensitive data includes financial data, social security number, usernames and passwords or health information. Attackers use this to gain access to such information and commit fraud or steal identities.

How can you prevent Sensitive Data Exposure attacks?

Sensitive Data Exposure attacks can be prevented by

• Using string and unique passwords
• Using the secure URLs
• Encrypting all the sensitive information that is not required to be stored

4. Software and Data Integrity Failures

Software and Data Integrity Failures occur when systems fail to verify the integrity of critical components such as software updates, data exchanges, and CI/CD pipelines. This vulnerability allows attackers to inject malicious code or compromise software supply chains, leading to unauthorised access, data manipulation, and potential system-wide breaches.

How can you prevent Software and Data Integrity Failures?

Software and Data Integrity failures can be prevented by

• Implementing digital signatures & code signing
• Use trusted third-party libraries
• Adopt a zero-trust approach

5. Broken Access Controls

Broken Access Controls occur when there is broken access to resources. This means that there are some improperly configured missing restrictions on authenticated users which allows them to get access to unauthorized functionality or data such as access to other accounts, confidential documents, and many more. While conducting this attack, attackers take help of session management and try to access the data from unexpired session tokens. By this, they can get access to many valid IDs and passwords.

How can you prevent Broken Access Control attacks?

Broken Access Controls can be prevented by

• Shutting down unnecessary services to reduce the burden on servers
• Deleting accounts that are no longer needed or not active
• Using penetration testing

6. Security Misconfiguration

As evidenced, most of the cloud breaches are because of  human errors and are prone to security misconfiguration vulnerability. This vulnerability is caused because of improper implementation of security intended to keep application data safe. This risk includes sensitive information that the attackers could exploit.The work of developers on the functionality of the websites and not on the security. This drawback allows the hackers to keep track of the configuration of the security and find various ways to intrude the websites. This can occur because of not upgrading systems, frameworks and components.

How can you prevent Security Misconfiguration attacks?

Security Misconfiguration attacks can be prevented by

• Disabling the use of default passwords
• Keeping  a check on cloud resources, applications and servers
• Using Dynamic application security testing (DAST)

7. Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) is a critical security vulnerability where an attacker tricks a server into making unintended requests to internal or external resources. Instead of targeting users directly, SSRF exploits the backend, bypassing network restrictions to gain unauthorized access to internal services, databases, or sensitive endpoints.

How can you prevent Server-Side Request Forgery (SSRF)?

Server-Side Request Forgery (SSRF) can be prevented by

• Ensuring user-supplied URLs are properly filtered and restricted to trusted sources
• Restrict internal services from being exposed to unnecessary external requests.
• Prevent applications from making unintended requests using protocols like HTTP, FTP, or file handlers.
• Implement strong authentication & access controls

8. Insecure Design

This vulnerability allows an attacker to remotely execute code in the application, tamper or delete serialized objects, conduct injection attacks, replay attacks and elevate privileges. Insecure Design is also known as untrusted Design. This vulnerability is a serious application security issue which affects many modern systems.

How can you prevent Insecure Design attacks?

Insecure Deserialization attacks can be prevented by

• Isolate the code that deserializes and runs it in low privilege environments to prevent unauthorized actions.
• Implementing digital signatures
• Using penetration testing

9. Vulnerable and Outdated Components

With the easy access to tools and software, there are many open-source and freely available software components, whether there is any component which is prone to a known vulnerability in it, then it can create an impact on the security of the entire application. It occurs because it is not in the information of the developers, which open-source and third-party components are present in their applications. This makes it difficult for developers to update components when new vulnerabilities are found in their present versions.

How can you prevent this attack?

This attacks can be prevented by

• Removing all unnecessary dependencies
• Using components only from official and verified sources
• Using virtual patching

10. Security Logging and Monitoring Failures

The estimated time from an attack to detection can take up to 200 days or more. In the course of time, attackers can tamper with servers, corrupt databases, and steal confidential information. Insufficient logging and ineffective integration of the security systems allows the attackers to intrude to other systems and maintain persistent threats.

How can you prevent Insufficient Logging and Monitoring attacks?

Insufficient Logging and Monitoring attacks can be prevented by

• Establishing an effective monitoring system
• Implementing logging and audit software
• Thinking from the view point of an attacker and use penetration testing approach

Want to start your learning journey on Cyber Security and Ethical Hacking field?