OWASP Top 10 (2021)

What's inside

What type of attack is being demonstrated here?

Compromise internal services – The attacker can abuse internal services to conduct further attacks such as Remote Code Execution (RCE) or Denial of Service (DoS).

A10 Server Side Request Forgery (SSRF)

What kind of attack is described in this situation?

Access metadata storage of cloud services – Most cloud providers have metadata storage such as http://169.254.169.254/. An attacker can read the metadata to gain sensitive information.

A10 Server Side Request Forgery (SSRF)

Can you identify the type of attack happening here?

Sensitive data exposure – Attackers can access local files or internal services to gain sensitive information such as file:///etc/passwd and http://localhost:28017/.

A10 Server Side Request Forgery (SSRF)

What type of attack is demonstrated in this scenario?

Port scan internal servers – If the network architecture is unsegmented, attackers can map out internal networks and determine if ports are open or closed on internal servers from connection results or elapsed time to connect or reject SSRF payload connections.

A10 Server Side Request Forgery (SSRF)

When should you consider using VPNs for frontend access?

For scenarios with high protection needs and manageable user groups.

Example: Using a VPN for admin access to a high-security financial application.

Why minimize services on front-end systems?

To reduce the attack surface exposed to potential SSRF attempts.

Example: Keeping only the web server on the front-end, moving application logic to separate servers.

Why are deny lists ineffective against SSRF?

Attackers have techniques to bypass these measures.

Example: Using URL encoding to bypass a blacklist of prohibited characters.

How can URL consistency awareness prevent attacks?

By mitigating risks like DNS rebinding and TOCTOU race conditions.

Example: Verifying that the resolved IP address matches the expected domain.

Why disable HTTP redirections for SSRF prevention?

To prevent the application from being tricked into accessing malicious sites.

Example: Disabling automatic following of 3xx redirect responses in HTTP clients.

Why avoid sending raw responses to clients?

To prevent exposure of sensitive information obtained through SSRF.

Example: Sanitizing error messages before sending them to the client.

How does logging network flows help prevent SSRF?

By providing visibility into potential SSRF attempts and anomalies.

Example: Logging all blocked requests to internal resources from web servers.

Why establish ownership for firewall rules?

To ensure proper management and regular review of access controls.

Example: Assigning each firewall rule to a specific team or application owner.

How can network segmentation reduce SSRF risks?

By isolating remote resource access functionality in separate networks.

Example: Placing web servers in a DMZ, separate from internal application servers.

Why is SSRF particularly dangerous in microservices architectures?

It can allow attackers to move laterally between different services.

Example: Using SSRF in one microservice to attack another internal service not exposed externally.

How can SSRF impact containerized environments?

It may allow access to the host system or other containers.

Example: An SSRF vulnerability in a container allowing access to the Docker socket on the host.

What role does input validation play in preventing SSRF?

Proper validation can prevent malicious URLs from being processed.

Example: Whitelisting allowed domains for a URL fetching feature to prevent SSRF.

How can SSRF lead to data breaches?

By allowing attackers to access and exfiltrate sensitive internal data.

Example: Using SSRF to retrieve and leak customer information from an internal database.

What makes SSRF detection challenging?

The malicious requests often appear to come from legitimate internal sources.

Example: An SSRF attack mimicking normal API calls between microservices.

How does cloud computing increase SSRF risks?

Cloud architectures often have complex internal networks vulnerable to SSRF.

Example: An SSRF vulnerability allowing access to other customers' data in a multi-tenant cloud environment.

What is "Server-Side Request Forgery (SSRF)" in OWASP Top 10 2021?

An attack where an application is tricked into making unintended server-side requests.

Example: An attacker manipulating a URL parameter to make an internal API call to delete user data.

What kind of attack is described in this situation?

A major European airline suffered a GDPR reportable breach. The breach was reportedly caused by payment application security vulnerabilities exploited by attackers, who harvested more than 400,000 customer payment records. The airline was fined 20 million pounds as a result by the privacy regulator.

A09 Security Logging and Monitoring Failures

Can you identify the type of attack happening here?

A major Indian airline had a data breach involving more than ten years' worth of personal data of millions of passengers, including passport and credit card data. The data breach occurred at a third-party cloud hosting provider, who notified the airline of the breach after some time.

A09 Security Logging and Monitoring Failures

What type of attack is illustrated in this scenario?

A children's health plan provider's website operator couldn't detect a breach due to a lack of monitoring and logging. An external party informed the health plan provider that an attacker had accessed and modified thousands of sensitive health records of more than 3.5 million children. A post-incident review found that the website developers had not addressed significant vulnerabilities. As there was no logging or monitoring of the system, the data breach could have been in progress since 2013, a period of more than seven years.

A09 Security Logging and Monitoring Failures

What role do log reviews play in security?

Regular log reviews can help identify security issues and improve monitoring processes.

Example: Weekly reviews of failed login attempts to identify potential brute force attack patterns.

How can log confidentiality be maintained?

By encrypting sensitive log data and controlling access to log storage systems.

Example: Encrypting logs containing personal data before transmitting them to a central log server.

Why is an incident response plan important?

To ensure a coordinated and effective approach to handling security incidents.

Example: Having a documented process for responding to a detected data breach, including roles and communication protocols.

How can DevSecOps teams enhance security monitoring?

By implementing effective monitoring and alerting systems for quick incident detection and response.

Example: Setting up a SIEM system to correlate logs from various sources and generate alerts.

What are integrity controls for high-value transactions?

Mechanisms to prevent tampering or deletion of audit trails for critical operations.

Example: Using an append-only database table to store financial transaction logs.

How can log injection attacks be prevented?

By properly encoding log data to prevent manipulation of log content or systems.

Example: Escaping special characters in user input before including it in log messages.

Why use standardized log formats?

To ensure easy consumption by log management solutions for efficient analysis.

Example: Using the Common Log Format for web server logs to facilitate processing by various tools.

What should be logged for security-related events?

All login attempts, access control, and server-side input validation failures with sufficient context.

Example: Logging failed login attempts with username, IP address, and timestamp.

How can log integrity be ensured?

By using tamper-evident logging mechanisms and secure storage.

Example: Using blockchain technology to create an immutable audit log of system changes.

What's the importance of log retention policies?

To ensure logs are available for future forensic analysis if needed.

Example: Keeping authentication logs for 90 days to investigate potential past breaches.

Why is real-time attack detection crucial?

To minimize damage by enabling immediate response to security incidents.

Example: Automatically blocking an IP address when it starts a DDoS attack.

How can penetration testing improve monitoring?

By ensuring monitoring systems can detect and alert on simulated attacks.

Example: Verifying that a web application firewall alerts on SQL injection attempts during a pentest.

What's the risk of storing logs only locally?

Loss of critical data if the local system is compromised or fails.

Example: An attacker deleting local logs to cover their tracks after a successful intrusion.

Why are clear and adequate log messages important?

To quickly understand and respond to potential security issues.

Example: A log message stating "User 'john_doe' failed login 5 times in 2 minutes" instead of just "Login error".

Why is security logging and monitoring crucial?

To detect, escalate, and respond to active breaches quickly.

Example: Using log analysis to identify a data exfiltration attempt in real-time.

What are "Security Logging and Monitoring Failures" in OWASP Top 10 2021?

Inadequacies in tracking and responding to security events and incidents.

Example: A system that doesn't log failed login attempts, making it hard to detect brute force attacks.

What kind of attack is described in this situation?

Application session timeouts aren't set correctly. A user uses a public computer to access an application. Instead of selecting "logout," the user simply closes the browser tab and walks away. An attacker uses the same browser an hour later, and the user is still authenticated.

A07 Identification and Authentication Failures

Can you identify the type of attack happening here?

Most authentication attacks occur due to the continued use of passwords as a sole factor. Once considered best practices, password rotation and complexity requirements encourage users to use and reuse weak passwords. Organizations are recommended to stop these practices per NIST 800-63 and use multi-factor authentication.

A07 Identification and Authentication Failures

What type of attack is happening in this scenario?

Credential stuffing, the use of lists of known passwords, is a common attack. Suppose an application does not implement automated threat or credential stuffing protection. In that case, the application can be used as a password oracle to determine if the credentials are valid.

A07 Identification and Authentication Failures

How can API security be enhanced for authentication?

By implementing rate limiting and consistent error responses.

Example: Limiting login API calls to 10 per minute per IP address.

What's the importance of secure credential recovery?

To prevent unauthorized access through weak password reset mechanisms.

Example: Sending a time-limited reset link to a pre-registered email address instead of asking security questions.

How can password strength be effectively measured?

By comparing against lists of common passwords and using entropy calculations.

Example: Using a password strength meter that checks against a database of breached passwords.

Why limit or delay failed login attempts?

To prevent brute force attacks without causing denial of service.

Example: Implementing a 30-second delay after 5 failed login attempts.

How can account enumeration attacks be prevented?

By providing consistent responses regardless of whether an account exists.

Example: Showing "If an account exists, a reset email has been sent" for all reset attempts.

What are modern password policy recommendations?

Focusing on length over complexity and avoiding frequent mandatory changes.

Example: Encouraging passphrases like "correct-horse-battery-staple" instead of "P@ssw0rd!".

How can weak password checks improve security?

By preventing users from choosing easily guessable passwords.

Example: Rejecting '123456' as a password during account creation.

Why should default credentials be avoided in deployments?

To prevent easy unauthorized access to newly deployed systems.

Example: Changing the default 'admin/admin' credentials on a new router before use.

What is credential stuffing?

An attack using stolen username/password pairs to gain unauthorized access.

Example: Using leaked email/password combinations to try logging into various websites.

Why is proper user authentication critical?

To prevent unauthorized access and protect against identity-related attacks.

Example: Ensuring only authorized users can access sensitive financial data.

What are "Identification and Authentication Failures" in OWASP Top 10 2021?

Weaknesses in systems that verify user identity and manage user sessions.

Example: A website that doesn't lock accounts after multiple failed login attempts.

What is a brute force attack?

Systematically trying many passwords to gain unauthorized access.

Example: A program that tries every possible 4-digit PIN on a locked phone.

Why is session ID reuse after login risky?

It can allow unauthorized users to take over authenticated sessions.

Example: Not generating a new session ID after a user logs in, potentially allowing old IDs to remain valid.

Why shouldn't session IDs be exposed in URLs?

It can lead to session hijacking and unauthorized access.

Example: Having a URL like "example.com/account?sessionid=1234", which can be easily copied.

What is multi-factor authentication (MFA)?

A security system requiring two or more forms of identification to grant access.

Example: Requiring both a password and a fingerprint scan to log in.

Why is storing passwords in plain text dangerous?

It allows anyone with database access to see users' passwords.

Example: Storing user passwords as clear text in a database file.

What's wrong with knowledge-based answers for password recovery?

They can often be guessed or obtained through social engineering.

Example: Using "mother's maiden name" as a security question, which might be publicly available.

What type of attack is demonstrated in this scenario?

Components typically run with the same privileges as the application itself, so flaws in any component can result in serious impact. Such flaws can be accidental (e.g., coding error) or intentional (e.g., a backdoor in a component). Some example exploitable component vulnerabilities discovered are:

CVE-2017-5638, a Struts 2 remote code execution vulnerability that enables the execution of arbitrary code on the server, has been blamed for significant breaches.

While the internet of things (IoT) is frequently difficult or impossible to patch, the importance of patching them can be great (e.g., biomedical devices).

There are automated tools to help attackers find unpatched or misconfigured systems. For example, the Shodan IoT search engine can help you find devices that still suffer from Heartbleed vulnerability patched in April 2014.

A06 Vulnerable and Outdated Components

How to handle unmaintained components lacking security patches?

By monitoring them closely and considering virtual patching when updates aren't possible.

Example: Using a Web Application Firewall to mitigate a vulnerability in a legacy library.

What should be removed during patch management?

Unused dependencies, features, components, files, and documentation.

Example: Removing unused modules from a content management system.

How can developers ensure component security when updating?

By testing the compatibility and security of updated libraries.

Example: Running a full test suite after updating a critical framework.

How can you stay informed about component vulnerabilities?

By regularly scanning for vulnerabilities and subscribing to security bulletins.

Example: Using tools like OWASP Dependency-Check in your CI/CD pipeline.

Why is it important to track component versions in your software?

To identify and address potential vulnerabilities quickly.

Example: Maintaining a list of all npm packages and their versions used in a project.

What are "Vulnerable and Outdated Components" in OWASP Top 10 2021?

Software elements with known security flaws or lacking necessary updates.

Example: Using an old version of jQuery with a known XSS vulnerability.

What type of attack is being demonstrated here?

A cloud service provider (CSP) has default sharing permissions open to the Internet by other CSP users. This allows sensitive data stored within cloud storage to be accessed.

A05 Security Misconfiguration

What kind of attack is described in this situation?

The application server's configuration allows detailed error messages, e.g., stack traces, to be returned to users. This potentially exposes sensitive information or underlying flaws such as component versions that are known to be vulnerable.

A05 Security Misconfiguration

Can you identify the type of attack happening here?

Directory listing is not disabled on the server. An attacker discovers they can simply list directories. The attacker finds and downloads the compiled Java classes, which they decompile and reverse engineer to view the code. The attacker then finds a severe access control flaw in the application.

A05 Security Misconfiguration

What type of attack is taking place in this situation?

The application server comes with sample applications not removed from the production server. These sample applications have known security flaws attackers use to compromise the server. Suppose one of these applications is the admin console, and default accounts weren't changed. In that case, the attacker logs in with default passwords and takes over.

A05 Security Misconfiguration

What role do cloud security groups play in preventing misconfigurations?

They provide a way to control network access to cloud resources, enhancing security.

Example: Using AWS security groups to limit database access to specific application servers.

How can containerization improve security?

By isolating applications and their dependencies, reducing the impact of potential breaches.

Example: Running different microservices in separate Docker containers.

What's the benefit of consistent configurations across environments?

It reduces the risk of security issues when moving from development to production.

Example: Using the same firewall rules in development and production environments.

What is a segmented application architecture?

A design that separates components or tenants to limit the impact of potential breaches.

Example: Using separate databases for different customer groups in a SaaS application.

What is a repeatable hardening process?

A standardized method to quickly deploy secure environments across development, QA, and production.

Example: Using automated scripts to apply security settings on all new servers.

How does keeping software up-to-date improve security?

It patches known vulnerabilities and adds new security features.

Example: Updating a WordPress installation to fix a known SQL injection flaw.

Why are security headers important in web applications?

They instruct the client's browser to enable specific security controls.

Example: Using the X-Frame-Options header to prevent clickjacking attacks.

What components need secure configuration in an application?

All components including servers, frameworks, libraries, and databases.

Example: Configuring proper access controls in a MySQL database.

Why is it crucial to enable the latest security features?

To protect against newly discovered threats and vulnerabilities.

Example: Enabling HTTP Strict Transport Security (HSTS) on a web server.

How can overly informative error messages be a security risk?

They may reveal sensitive information that aids attackers in exploiting vulnerabilities.

Example: A database error exposing table names and query structure.

Why should unnecessary features be disabled?

To reduce the attack surface and minimize potential vulnerabilities.

Example: Disabling unused modules in a content management system.

How can cloud service misconfigurations lead to vulnerabilities?

Improper permission settings can allow unauthorized access to resources.

Example: Accidentally making an S3 bucket publicly readable.

Why is security hardening important across the application stack?

To reduce vulnerabilities by properly configuring all components of the application.

Example: Disabling unnecessary services on a web server.

What is "Security Misconfiguration" in OWASP Top 10 2021?

Vulnerabilities resulting from improper configuration of application components.

Example: Using default credentials on a production database server.

What kind of attack is described in this situation?

A retail chain’s e-commerce website does not have protection against bots run by scalpers buying high-end video cards to resell on auction websites. This creates terrible publicity for the video card makers and retail chain owners and enduring bad blood with enthusiasts who cannot obtain these cards at any price. Careful anti-bot design and domain logic rules, such as purchases made within a few seconds of availability, might identify inauthentic purchases and reject such transactions.

A04 Insecure Design

Can you identify the type of attack happening here?

A cinema chain allows group booking discounts and has a maximum of fifteen attendees before requiring a deposit. Attackers could threat model this flow and test if they could book six hundred seats and all cinemas at once in a few requests, causing a massive loss of income.

A04 Insecure Design

What type of attack is associated with this situation?

A credential recovery workflow might include “questions and answers,” which is prohibited by NIST 800-63b, the OWASP ASVS, and the OWASP Top 10. Questions and answers cannot be trusted as evidence of identity as more than one person can know the answers, which is why they are prohibited. Such code should be removed and replaced with a more secure design.

A04 Insecure Design

How can limiting resource consumption improve security?

By preventing denial of service and ensuring fair usage across users or services.

Example: Setting a maximum number of API calls per user per minute.

What is tier segregation in system design?

Separating application layers based on their exposure and protection needs.

Example: Isolating the database server from direct internet access.

What are plausibility checks in application design?

Validations at each tier of the app to ensure inputs and processes are correct and secure.

Example: Checking if a user's age input is within a reasonable range.

Why integrate security into user stories?

To ensure security is considered from the beginning of the development process.

Example: Including "verify user identity" in a story about account creation.

How does threat modeling contribute to secure design?

By identifying potential threats to critical aspects of the application early in development.

Example: Analyzing possible attacks on a new payment processing feature.

What is a secure design pattern library?

A collection of pre-approved, secure software components that developers can use.

Example: A library containing a properly implemented password hashing function.

How can security be integrated throughout development?

By involving security experts from project inception to completion.

Example: Having security reviews at each stage of an agile development process.

What contributes to insecure design?

Lack of risk assessment and security planning in early development stages.

Example: Not considering potential data breaches when designing a user database.

Can secure designs have vulnerabilities?

Yes, through implementation errors, but they're easier to fix than design flaws.

Example: A well-designed authentication system with a bug in password hashing.

How does insecure design differ from insecure implementation?

Design flaws are in the system's architecture; implementation flaws are in the code.

Example: Designing a system without access controls vs. incorrectly coding access checks.

What is "Insecure Design" in OWASP Top 10 2021?

A category of security risks resulting from missing or ineffective security controls in software design.

Example: A banking app allowing unlimited login attempts without lockouts.

What kind of attack is described in this situation?

A React application calls a set of Spring Boot microservices. Being functional programmers, they tried to ensure that their code is immutable. The solution they came up with is serializing the user state and passing it back and forth with each request. An attacker notices the "rO0" Java object signature (in base64) and uses the Java Serial Killer tool to gain remote code execution on the application server.

A08 Software and Data Integrity Failures

Can you identify the type of attack happening here?

Nation-states have been known to attack update mechanisms, with a recent notable attack being the SolarWinds Orion attack. The company that develops the software had secure build and update integrity processes. Still, these were able to be subverted, and for several months, the firm distributed a highly targeted malicious update to more than 18,000 organizations, of which around 100 or so were affected. This is one of the most far-reaching and most significant breaches of this nature in history.

A08 Software and Data Integrity Failures

What type of attack is demonstrated in this scenario?

Many home routers, set-top boxes, device firmware, and others do not verify updates via signed firmware. Unsigned firmware is a growing target for attackers and is expected to only get worse. This is a major concern as many times there is no mechanism to remediate other than to fix in a future version and wait for previous versions to age out.

A08 Software and Data Integrity Failures

How can serialized data transmission be made more secure?

By adding integrity checks or digital signatures to detect tampering.

Example: Using HMAC to sign JSON Web Tokens before sending them to clients.

Why is code review important for preventing integrity failures?

It helps catch malicious code or configuration changes before they're deployed.

Example: A team member spotting a suspicious API call during a pull request review.

How can digital signatures prevent integrity failures?

By verifying the authenticity and integrity of software or data.

Example: Verifying a downloaded software package's GPG signature before installation.

What is insecure deserialization?

Converting serialized data to objects without proper security checks.

Example: A Java application deserializing user-supplied data without validation, allowing code execution.

Why is auto-update functionality a potential security risk?

It may apply unverified updates, potentially distributing malware.

Example: A fake update server tricking applications into installing malicious code.

What risks do insecure CI/CD pipelines pose?

They can allow unauthorized code changes or malicious injections during deployment.

Example: An attacker accessing an unsecured Jenkins server to inject malware into builds.

How can untrusted libraries compromise software integrity?

By introducing vulnerabilities or malicious code into the application.

Example: Using a compromised npm package that steals user data.

What are "Software and Data Integrity Failures" in OWASP Top 10 2021?

Issues related to code and data that can be tampered with due to insufficient verification.

Example: An application accepting software updates without verifying their source.

Can you identify the type of attack happening here?

Similarly, an application’s blind trust in frameworks may result in queries that are still vulnerable, (e.g., Hibernate Query Language (HQL)):

Query HQLQuery = session.createQuery("FROM accounts WHERE custID='" + request.getParameter("id") + "'");

In both cases, the attacker modifies the ‘id’ parameter value in their browser to send: ' UNION SLEEP(10);--. For example:

http://example.com/app/accountView?id=' UNION SELECT SLEEP(10);--

This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data or even invoke stored procedures.

A03 Injection

What type of attack is being carried out in this situation?

An application uses untrusted data in the construction of the following vulnerable SQL call:

String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'";

A03 Injection

How to prevent mass record disclosure in SQL injection?

Use SQL controls like LIMIT to restrict query results.

Example: Adding "LIMIT 1000" to queries to cap the number of returned records.

Why are user-supplied structure names dangerous in SQL?

They can't be safely escaped, allowing potential schema manipulation.

Example: Allowing users to specify table names in a custom report builder.

How to handle special characters in dynamic queries?

Escape them using the specific syntax for that interpreter.

Example: Using MySQLi's real_escape_string() for MySQL queries in PHP.

How to best detect injection vulnerabilities?

Through source code review and automated security testing.

Example: Using SAST tools to analyze code for potential SQL injection points.

What are common types of injection attacks?

SQL, NoSQL, OS command, LDAP, and Expression Language injection.

Example: OS command injection in a file upload feature.

How can ORM be exploited?

By manipulating search parameters to access unauthorized data.

Example: Modifying an ORM query to bypass filters and access all records.

What are parameterized queries?

Queries separating data from SQL commands, preventing injection.

Example: Using prepared statements in Java with JDBC.

What makes an application vulnerable to injection?

Improper handling of user-supplied data in queries or commands.

Example: Directly concatenating user input into an SQL query.

What is "Injection" in OWASP Top 10 2021?

Vulnerabilities allowing attackers to insert malicious code into applications.

Example: SQL injection attack manipulating a database query.

What kind of attack is described in this situation?

The password database uses unsalted or simple hashes to store everyone's passwords. A file upload flaw allows an attacker to retrieve the password database. All the unsalted hashes can be exposed with a rainbow table of pre-calculated hashes. Hashes generated by simple or fast hash functions may be cracked by GPUs, even if they were salted.

A02 Cryptographic Failures

Can you identify the type of attack happening here?

A site doesn't use or enforce TLS for all pages or supports weak encryption. An attacker monitors network traffic (e.g., at an insecure wireless network), downgrades connections from HTTPS to HTTP, intercepts requests, and steals the user's session cookie. The attacker then replays this cookie and hijacks the user's (authenticated) session, accessing or modifying the user's private data. Instead of the above they could alter all transported data, e.g., the recipient of a money transfer.

A02 Cryptographic Failures

What type of attack involves the following situation?

An application encrypts credit card numbers in a database using automatic database encryption. However, this data is automatically decrypted when retrieved, allowing a SQL injection flaw to retrieve credit card numbers in clear text.

A02 Cryptographic Failures

Why verify cryptographic configurations independently?

To ensure they're functioning correctly and providing intended protection.

Example: Using third-party security audits to verify TLS configurations.

How should cryptographic keys be handled?

Generated randomly and stored securely as byte arrays.

Example: Using a hardware security module (HSM) to generate and store keys.

What's better than just encryption?

Authenticated encryption, ensuring both confidentiality and integrity.

Example: Using AES-GCM instead of AES-CBC for data protection.

Why use strong, salted hashing for passwords?

To make password recovery from hashes extremely difficult.

Example: Using bcrypt instead of MD5 for password storage.

Why avoid legacy protocols for sensitive data?

They lack modern security features and encryption.

Example: Using SFTP instead of FTP for file transfers.

Why apply security controls based on data classification?

To ensure appropriate protection levels for different data types.

Example: Using multi-factor authentication for accessing financial records.

Why disable caching for sensitive responses?

To prevent sensitive data from being stored in insecure locations.

Example: Setting 'Cache-Control: no-store' for pages with personal info.

Why encrypt sensitive data at rest?

To protect data even if physical storage is compromised.

Example: Encrypting stored passwords in case the database is stolen.

Why discard unnecessary sensitive data?

To reduce the risk and impact of potential data breaches.

Example: Deleting credit card details after a transaction is completed.

What's the first step in preventing cryptographic failures?

Classify data and identify sensitive information.

Example: Categorizing customer data as public, internal, or confidential.

Where to find guidance on cryptographic best practices?

In OWASP resources like ASVS Crypto, Data Protection, and SSL/TLS sections.

Example: Consulting ASVS V7 for proper key management practices.

How can cryptographic error messages be exploited?

They may leak information useful for attacks.

Example: A padding oracle attack exploiting detailed decryption error messages.

Why is cryptographic randomness crucial?

To prevent predictability in security-critical operations.

Example: Using a cryptographically secure random number generator for session tokens.

What's the risk of using passwords as cryptographic keys?

It can lead to weak encryption if not properly processed.

Example: Directly using a user's password to encrypt files, instead of deriving a key.

Why are initialization vectors important in cryptography?

To ensure unique encryption results, even for identical data.

Example: Using a unique IV for each AES encryption operation.

What's important about server certificates?

They should be properly validated to prevent man-in-the-middle attacks.

Example: Checking certificate expiration dates and trusted certificate authorities.

Where should encryption be enforced?

In all data transmissions, both external and internal.

Example: Using TLS for communication between web servers and databases.

Why is proper key management crucial?

To prevent unauthorized access and ensure cryptographic integrity.

Example: Regularly rotating encryption keys and securely storing them.

What's the risk of using old cryptographic algorithms?

They may have known vulnerabilities, making data easier to compromise.

Example: Using DES encryption, which is now considered insecure.

Why is clear text data transmission dangerous?

It's vulnerable to interception, especially over external networks.

Example: Sending login credentials over HTTP instead of HTTPS.

What types of data require extra cryptographic protection?

Sensitive information like passwords, credit card numbers, and personal data.

Example: Encrypting social security numbers before storing in a database.

What is "Cryptographic Failures" in OWASP Top 10 2021?

Security issues related to cryptography, often leading to data exposure.

Example: Using outdated encryption algorithms like MD5 for password storage.

What type of attack is happening here?

An attacker simply forces browsing to target URLs. Admin rights are required for access to the admin page.

https://example.com/app/getappInfo
https://example.com/app/admin_getappInfo

If an unauthenticated user can access either page, it's a flaw.

If a non-admin can access the admin page, this is a flaw.

A01 Broken Access Control

What type of attack is being performed in this situation?

The application uses unverified data in a SQL call that is accessing account information:

pstmt.setString(1, request.getParameter("acct"));
ResultSet results = pstmt.executeQuery( );

An attacker simply modifies the browser's 'acct' parameter to send whatever account number they want. If not correctly verified, the attacker can access any user's account.

https://example.com/app/accountInfo?acct=notmyacct

A01 Broken Access Control

What's the role of access control testing?

To ensure correct implementation and detect unauthorized access attempts.

Example: Writing unit tests to verify admin functions are inaccessible to regular users.

How to handle session identifiers after logout?

Invalidate on the server; use short-lived JWTs for stateless sessions.

Example: Deleting session data from the server when a user logs out.

Why implement rate limiting?

To minimize harm from automated attacks and prevent abuse.

Example: Limiting API calls to 100 per hour per user.

How to handle access control failures?

Log failures and trigger alerts for administrators.

Example: Sending an email to admins after 5 failed access attempts in 1 minute.

How should access control mechanisms be used?

Implement once and reuse throughout the application.

Example: Creating a central authorization service used by all app modules.

What's the recommended default access policy?

Deny access by default, except for public resources.

Example: Requiring authentication for all pages except the homepage and login page.

Where should access control be implemented?

In trusted server-side code or server-less API.

Example: Implementing user role checks in backend PHP code, not in JavaScript.

What is "elevation of privilege"?

Gaining higher-level permissions than intended.

Example: A regular user accessing admin features by modifying a cookie.

Why are access controls important for POST, PUT, and DELETE requests?

To prevent unauthorized data modification or deletion.

Example: Ensuring only account owners can delete their own posts.

What are "insecure direct object references"?

Exposing internal implementation objects without access checks.

Example: Accessing order #123 by changing URL from order/789 to order/123.

How can access control checks be bypassed?

By manipulating requests, URLs, or application state.

Example: Changing a user ID in a URL to access another user's profile.

What is the "principle of least privilege"?

Granting users only the minimum permissions necessary for their tasks.

Example: Giving a content editor rights to edit articles but not system settings.

What is the main purpose of access control?

To enforce user permissions and prevent unauthorized actions.

Example: Ensuring only HR staff can access employee salary information.

What is "Broken Access Control" in OWASP Top 10 2021?

The most critical web application security risk, involving unauthorized access to resources or actions.

Example: A regular user accessing admin functions by modifying the URL.

What is "force browsing"?

Attempting to access restricted pages by guessing URLs.

Example: A user trying to access "/admin" pages without proper authentication.

What is CORS misconfiguration?

Improper setup of Cross-Origin Resource Sharing, allowing unauthorized access.

Example: A misconfigured API accepting requests from any origin, not just trusted ones.

How can metadata manipulation be a security risk?

By altering tokens or hidden fields to gain unauthorized access.

Example: Modifying a JWT token to change user roles or permissions.

What is the OWASP Top 10?

A regularly updated list of the most critical web application security risks.

Example: "Broken Access Control" was the top risk in the 2021 edition.

What is OWASP?

A non-profit organization providing free resources on web application security.

Example: OWASP offers tools like ZAP (Zed Attack Proxy) for security testing.