OWASP Top 10 — 2021
|
# |
Vulnerability |
Description |
Prevention |
|
A01 |
Broken Access Control |
Users access unauthorized resources |
Role-based access, server-side checks |
|
A02 |
Cryptographic Failures |
Sensitive data exposed due to weak crypto |
Use TLS, strong hashing (bcrypt) |
|
A03 |
Injection (SQLi, OS) |
Untrusted input executed as commands |
Parameterized queries, input validation |
|
A04 |
Insecure Design |
Missing security controls in design phase |
Threat modeling, secure SDLC |
|
A05 |
Security Misconfiguration |
Default passwords, open cloud storage |
Hardening guides, config reviews |
|
A06 |
Vulnerable Components |
Using outdated libraries with CVEs |
Regular patching, dependency scanning |
|
A07 |
Auth Failures |
Weak passwords, session management flaws |
MFA, secure session tokens |
|
A08 |
Data Integrity Failures |
Deserialization, CI/CD pipeline attacks |
Verify signatures, code signing |
|
A09 |
Logging Failures |
No monitoring of security events |
Centralized logging, SIEM alerts |
|
A10 |
SSRF |
Server fetches attacker-controlled URLs |
Whitelist allowed URLs, block internal IPs |
SQL Injection — Deep Dive
- Classic: ‘ OR ‘1’=’1 — Always-true condition to bypass login
- Union-Based: UNION SELECT username, password FROM users–
- Blind SQLi: No visible output — infer data from true/false responses
- Tool: sqlmap -u ‘http://target/page?id=1’ –dbs — Automated SQLi detection
|
Lab: Install DVWA on your Kali VM. Complete all exercises at ‘Low’ security level first: SQLi, XSS, CSRF, File Upload. Then repeat at ‘Medium’ and ‘High’ security levels. |