Questions tagged [owasp-top-ten]
For questions about the top ten list itself, such as categorization or inclusion criteria. Do not use just because the vulnerability you are asking about is on the list.
42
questions
2
votes
0
answers
25
views
What does OWASP mean by max incidence and average incidence rate?
Can someone please explain what is meant by the following analysis provided in the overview section of the OWASP Top 10 A03:2021 – Injection page:
Injection slides down to the third position. 94% of ...
- 7,669
0
votes
1
answer
94
views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
2
answers
881
views
Prevent URL encoding on form submit
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
- 271
1
vote
1
answer
555
views
Blind XXE - Exfiltration Data via OOB
My lab
Kali Linux:192.168.171.134
bWApp Server: http://192.168.171.131
I want to do an exfiltration data via HTTP on this Blind XXE.
I'll use the Portswigger Payload.
This is the External.DTD:
&...
- 21
1
vote
0
answers
110
views
Prevent XXE attack by preprocessing XML
I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE.
It is difficult to update the project to use newer versions of XML ...
- 149
2
votes
1
answer
143
views
Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?
I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
- 23
4
votes
1
answer
262
views
Exploitation of client_id in OAuth
We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
- 41
0
votes
0
answers
95
views
Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure
Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
2
votes
1
answer
590
views
How exactly works this SQL injection example related to the DVWA application?
I am a software developer converting do application security and I have some doubts about SQL injection example.
I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/
So I have ...
- 235
1
vote
3
answers
4k
views
JWT(Json Web Token) Tampering
I'm reading OWASP Top 10 - 2017
The Ten Most Critical Web Application Security Risks, and came across the following risk, under Broken Access Control vulnerabilities:
Metadata manipulation, such as ...
- 111
0
votes
1
answer
104
views
Does A6 - Security Misconfiguration be reported for embedded JS? [duplicate]
We have a HTML file with a minified JSlibrary pasted inside with the license header and version number.
Our client reported that it's a security risk (https://www.owasp.org/index.php/Top_10-2017_A6-...
- 481
38
votes
5
answers
12k
views
Is it really Security Misconfiguration to show a version number?
Our web application uses a HTML file with jQuery embedded inside.
According to the jQuery license (https://jquery.org/license/), we have to leave the license header intact, including the version ...
- 481
0
votes
0
answers
172
views
Unsafe deserialization from JSON
Seeking any example of exploitable unsafe deserialiazation where the serialized format is json and not some binary format.
Even better would be an example where calling a Java constructor of an ...
- 1,652
3
votes
1
answer
398
views
Why OWASP considers TouchID as insecure?
As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that
If the mobile app uses a feature like TouchID, it suffers from insecure authentication.
The reasons for this are ...
- 133
1
vote
1
answer
366
views
Origin Header Vs Token based mitigation
OWASP CSRF Prevention cheatsheet talks about two popular mitigations for CSRF - Origin/Referrer header check and Token based.
Are there any issues Origin/referrer check based mitigation that could ...
- 11
2
votes
1
answer
4k
views
Insecure Deserialization in C# (.NET) - How to identify and test
I have been reading up on Insecure Deserialization and how it can affect Java applications.
https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization
If the captured traffic data include ...
- 677
2
votes
1
answer
1k
views
Understanding OWASP 2017 A8 Insecure Deserialization
I'm reading up on Insecure Deserialization and remembered a vulnerability that I read about in some JSON Web Token (JWT) implementations at auth0.
https://owasp.org/index.php/Top_10-2017_A8-...
- 677
1
vote
1
answer
2k
views
URI redirect with only query parameters
Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters?
In pseudo-code, creation of the URI looks like this:
URI = "/example/path?" +
"...
- 575
1
vote
3
answers
611
views
Test for OWASP Using Components with Known Vulnerabilities?
I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities".
If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
- 11
5
votes
1
answer
249
views
Malicious NPM Package - Does it fit into OWASP Top Ten 2017?
On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title:
I’m harvesting credit card numbers and passwords from your site....
- 677
-1
votes
1
answer
1k
views
How to test for OWASP Top 10 vulnerability - Underprotected APIs [closed]
I researched over the internet but I couldn't find any tool/ways for checking the OWASP Top 10 vulnerability - Underprotected APIs. Please anyone can suggest how to proceed with testing Underprotected ...
- 155
3
votes
3
answers
1k
views
Checking if a web application uses known vulnerable components
I've been doing research on the OWASP top 10 web application vulnerabilties, one of them is using components with know vulnerabilities. I'm a little confused here, as I don't understand how you could ...
- 43
3
votes
1
answer
591
views
How does OWASP rank the top 10 risks?
I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that "Broken Account and Session Management" has changed place over the years:
In 2003 and ...
5
votes
0
answers
223
views
How to encrypt cookies in Xamarin?
I have a Xamarin application which creates a few files in /data/data/my.app.com/app_webview after using it.
The problem is that the cookies file is a file which contains session cookies. According ...
- 481
-1
votes
1
answer
208
views
sql injection attack or vulnerability? Where can i find list of web application vulnerabilities and attack types ? [closed]
I can't separate OWASP Top-10 security risks, Sql Injection is attack or vulnerability ? If Sql injection is web application attack type(and other owasp security risks), then where can i find ...
- 117
3
votes
1
answer
2k
views
Is a non-authenticated CSRF still a CSRF?
OWASP defines Cross-Site Request Forgery (CSRF) as
an attack that forces an end user to execute unwanted actions on a web
application in which they're currently authenticated.
(emphasis mine)
...
- 8,957
3
votes
2
answers
6k
views
How is Insufficient Attack Protection a Definite Threat/Risk to an Organization?
Recently, OWASP introduced two new set of categories as of 2017, April - to it's OWASP Top 10:
Insufficient Attack Protection
Unprotected APIs
I understand, Unprotected APIs does have an immediate ...
- 1,602
2
votes
1
answer
544
views
What vulnerabilities other than directory traversal come under IDOR?
The most common vulnerability in the OWASP category Insecure direct object reference is directory traversal. What are the other vulnerabilities which fall into this category?
9
votes
4
answers
4k
views
Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?
Latest edition of OWASP Top 10 for web application was in 2013 and for mobile applications, it is 2016. Why is it so?
Can we say that the pattern in the web application vulnerabilities is settled? ...
- 1,781
-1
votes
2
answers
197
views
Need help understanding OWASP Vulnerabilities [closed]
I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
- 2,603
2
votes
3
answers
3k
views
Deciding CVSS v3 scope parameter for a few OWASP top 10 vulnerabilities
I am trying to score owasp top 10 on cvss v3 and I am having difficulties assigning "scope" parameter for some. Please correct the below list if there are some faults.
SQL Injection: Changed.
...
- 1,781
14
votes
2
answers
4k
views
Is the injection in a NoSQL database architecture also called SQL injection?
Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection?
For example, an injection in code that communicates ...
- 6,234
2
votes
2
answers
278
views
How to categorise web vulnerabilities in a report?
What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like:
Websites,
Web applications,
Web shops,
Any interface using web-...
- 6,234
0
votes
1
answer
90
views
Need help to define existing web app vulnerability
I found vulnerability in a web app where I could manipulate URL parameters, i.e. take host/friends.php and then change it to host/friends.php?view=username and as a result see the users friends and ...
- 39
3
votes
7
answers
2k
views
Are URL shorteners "vulnerable" due to open redirects?
The OWASP state that open redirect is a vulnerability:
An open redirect is an application that takes a parameter and
redirects a user to the parameter value without any validation. This
...
- 3,253
3
votes
2
answers
2k
views
What vulnerabilities in the OWASP Top 10 are relevant to WordPress?
I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?
I know injections and XSS are ...
- 197
11
votes
3
answers
1k
views
OWASP Top 10 style security guide for implementation in hardware devices
I've seen OWASP Top 10 guides for web apps, native apps, etc., but never anything for embedded systems or hardware devices. These usually involve microcontrollers (e.g. Atmega / PIC) or small ...
- 132k
9
votes
5
answers
835
views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
- 193
2
votes
1
answer
228
views
Types of attacks outside of AppSec and Vendor-Specific Systems?
I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
- 911
5
votes
3
answers
1k
views
OWASP Top 10? How about OWASP Top 1000?
Many people are aware of the "OWASP Top 10". I'm wondering if OWASP (or any similar authority) has gone above and beyond just the top 10 most commons attacks and made a larger list (e.g. the "OWASP ...
- 911
7
votes
2
answers
337
views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
- 646
6
votes
3
answers
344
views
What indicators did OWASP use to end up with OWASP Top 10?
I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ...
Knowing that each of these ...
- 2,167