OWASP Top 10 Web
Application
Vulnerabilities
Mr. Mohsin Waseer
. . .
. . .
. . .
OWASP
• OWASP stands for Open Web
Application Security Project.
• It is an international nonprofit
organization that works to
improve software and web
application security.
• OWASP provides free tools,
research, documentation, and
guidelines to help developers
build secure systems.
. . . .
. . . .
. . . .
. . .
. . .
. . .
OWASP Top 10 Web
Application
Vulnerabilities
• One of the most famous
contributions of OWASP is the
OWASP Top 10, which is a list of
the most critical web application
security vulnerabilities.
• This list helps organizations
understand the major risks that
can affect websites and online
applications.
. . . .
. . . .
. . . .
1
Broken Access
Control
Broken Access Control
occurs when users can access data or
perform actions that they are not
Risks
authorized to use.
Example:
Prevention
A normal user changes the URL and
gains access to the admin panel.
Broken Access
Control
• Unauthorized access to sensitive
data
Risks
• Data modification or deletion
Prevention
• Privacy violations
Broken Access
Control
• Implement role-based access
control
Risks
Prevention
• Deny access by default
• Regularly test user permissions
2
Cryptographic
Failures
Cryptographic Failures
happen when sensitive information is
not properly protected using
Risks
encryption..
Example:
Prevention
Passwords stored in plain text
instead of encrypted format
Cryptographic
Failures
o Data theft
o Identity theft
Risks
o Financial loss
Prevention
Cryptographic
Failures
Risks
o Use strong encryption algorithms
o Use HTTPS instead of HTTP
o Securely hash passwords
Prevention
Injection Attacks
Injection is a vulnerability where an
attacker inserts malicious code through
user input, causing the application to
perform unintended actions.
Example
SQL Query:
SELECT * FROM StudentsWHERE
StudentID = ‘45';
 Unauthorized access to data
 Use parameterized queries
 Data modification or deletion
 Validate and sanitize user input
 Loss of confidentiality
 Perform regular security testing and
code reviews
Insecure Design
Insecure Design occurs when
security is not properly considered
during the design phase of an
application
Example
A company developed a login system but
did not add a limit on login attempts. An
attacker could try thousands of passwords
until the correct one was found
 Security flaws from the beginning
 Financial losses
 Increased risk of attacks
 Follow a Secure Software Development
Lifecycle (SDLC)
 Perform threat modeling
 Include security requirements in the
design process.
 Conduct regular security testing
Security Misconfiguration
Security Misconfiguration occurs when
security settings are incorrectly configured
or left at their default values
Example
A website was deployed with the default
username and password (admin/admin123)
 Unauthorized access
 Change default usernames and
passwords
 Data leakage
 Remove unnecessary services and
features
 System compromise
 Keep software updated
 Regularly review security
configurations
xample
isks
evention
 Using an old software, plugins, or libraries
 Using an outdated framework with security
flaws.
6
Vulnerable and
Outdated
 Malware attacks
Components
 Data breaches
 Update software regularly
 Remove unsupported components
 Monitor security advisories
Example
6
 Using an old software, plugins, or libraries
 Using an outdated framework with security
flaws.
Vulnerable and
Outdated
Components
Risks
Prevention
 Malware attacks
 Data breaches
Using old software,
plugins, or libraries
with known
 Update
software regularly
vulnerabilities.
 Remove unsupported components
 Monitor security advisories
xample
isks
evention
 Using an old software, plugins, or libraries
 Using an outdated framework with security
flaws.
7
Identification and
 Malware attacks
Authentication
 Data breaches
Failures
 Update software regularly
 Remove unsupported components
 Monitor security advisories
 Weak passwords
Example
7
 Session hijacking
 No Multi-Factor Authentication (MFA)
Risks
Prevention
Identification
and
Authentication
 Account hacking
Failures
 Unauthorized access
Weak authentication
systems allow
attackers to access
 Useaccounts.
strong password policies
 Enable MFA
 Secure session management
xample
isks
evention
 Using an old software, plugins, or libraries
 Using an outdated framework with security
flaws.
8
Software and
 Malware attacks
Data Integrity
 Data breaches
Failures
 Update software regularly
 Remove unsupported components
 Monitor security advisories
Example
8
 Installing fake software updates from untrusted
sources.
Software and
Data Integrity
Failures
Risks
 Malware installation
 System compromise
Applications trust
software updates or
data without
verification.
 Verify
software integrity
Prevention
 Use trusted repositories
 Secure CI/CD pipelines
9
Security Logging and
Monitoring Failures
Security
Logging
and
Monitoring
Failures
occur
when applications do not
properly record, monitor, or
respond to security events,
making it difficult to detect
attacks
Equifax Data
Breach (2017)
Impacts
Prevention
 Enable
• Delayed detection of
cyber attacks
• Increased data breach
risks
• Difficulty in incident
investigation
• Financial
and
reputational damage
comprehensive
logging of security events
 Monitor logs in real time
 Set up automated alerts
for suspicious activities
 Regularly
review
and
analyze logs
 Implement
response plan
an
incident
10
Server-Side Request
Forgery (SSRF)
Server-Side Request Forgery
(SSRF) is a web security
vulnerability that allows an
attacker to make the server
send unauthorized requests to
internal or external resources.
Capital One Data
Breach (2019)
Prevention
Impacts
 Validate and sanitize all user-
• Access
to
sensitive
internal systems
• Exposure of confidential
data
• Cloud service compromise
• Bypass of security controls
supplied URLs
 Use allow lists for permitted
destinations
 Restrict
server
outbound
requests
 Disable unnecessary network
services
 Implement
network
segmentation and firewalls
Conclusion
• The OWASP Top 10 helps developers and
organizations understand the most critical web
security risks.
• By following secure coding practices and
regularly testing applications, organizations can
reduce cyber threats and protect sensitive data.
• Cybersecurity is essential in today’s digital
world because secure applications protect both
businesses and users.
Prevention is better than cure in cybersecurity