In this lesson,
we explore the Open Web Application Security Project,
also known as OWASP,
which is a go-to resource in a cybersecurity field.
OWASP mainly focuses on the security of web applications.
We will discuss what OWASP is
and examine why its Top 10 List is a useful tool
for individuals involved
in the security of web applications,
ranging from developers all the way to penetration testers.
OWASP is a non-profit foundation
that is known for its commitment
to improving software security.
It achieves this through community-led,
open-source software projects,
hundreds of local chapters worldwide,
tens of thousands of members,
and by organizing both local and global conferences.
The mission of OWASP is simple,
to make software security visible so that individuals
and organizations around the globe
can make informed decisions
about true software security risks.
One of the most significant resources OWASP offers
is the OWASP Top 10, a list that is updated every few years
to identify the ten most critical
web application security risks.
Understanding these risks is vital
for anyone conducting a security assessment
or PenTests on web applications,
as it helps focus testing on efforts and areas
that are most likely to be exploited.
So as of this recording, here are the top 10:
1. we have Broken Access Control,
2. Cryptographic Failures, 3. Injection,
4. Insecure Design, 5. Security Misconfiguration,
6. Vulnerable and Outdated Components,
7. Identification and Authentication Failures,
8. Software and Data Integrity Failures,
9. Security Logging and Monitoring Failures,
and 10. Server-Side Request Forgery.
Let's discuss the top 3
just to give you a refresher of their meaning.
First up, we have Broken Access Control,
which is in the top spot
due to its widespread occurrence across applications.
Now, this vulnerability occurs
when restrictions on what authenticated users
are allowed to do are not properly enforced.
Users can exploit these flaws
to access unauthorized functionality or data,
such as accessing other users' accounts,
viewing sensitive files, and modifying other users' data.
For example, an online banking application allows users
to view their account details by accessing a URL like
bank.com/account?userID=1234.
Now, if the application does not properly verify
that the user requesting account is indeed user 1234,
an attacker could change the userID in the URL
to any other valid userID, gaining unauthorized access
to another user's account details.
Next, there's Cryptographic Failures,
which used to be labeled as Sensitive Data Exposure.
Cryptographic Failures moved up to the second position
due to its big impact on data confidentiality and integrity.
This category includes failures related
to managing sensitive data securely,
such as improper encryption or erroneous implementation
that leaves data exposed.
Imagine a web application
that uses custom encryption
rather than standard cryptographic protocols
to store passwords.
Due to an error in the encryption algorithm,
it produces consistent, predictable outputs
for similar inputs, which an attacker exploits
using a rainbow table to decrypt all user passwords
stored in the database.
Third, we have Injection Flaws.
Injection flaws, including SQL, NoSQL,
Command Injection, et cetera,
have moved down to the third spot,
but remain highly dangerous.
These occur when untrusted data is sent to an interpreter
as part of a command or query.
The attacker's hostile data can trick the interpreter
into executing unintended commands
or accessing data without proper authorization.
For example, consider a website
that uses a Dynamic SQL queries
to fetch user information from a database.
An attacker uses the user input form
to inject SQL code into the query.
For instance, entering 105; DROP TABLE Users;
into the user ID input field could cause the database
to execute this harmful command
if the input is not properly sanitized
and stripped of special characters prior to processing,
potentially leading to the deletion of the Users table.
So as you can see in the realm of pen testing,
OWASP Top 10 is used as a foundational checklist
or starting point
for assessing web applications for vulnerabilities.
By concentrating on the risks outlined in the list,
testers can ensure
that they are addressing the most fundamental
and frequently exploited vulnerabilities
in web applications.
So remember, OWASP and using its Top 10 list
is almost a non-negotiable
for anyone involved in web application security.
By becoming familiar with this list,
you can significantly deepen your understanding
of web application vulnerabilities,
better prepare for penetration tests,
and ultimately, contribute to securing applications
from common threats.
This foundational knowledge is important,
not only for conducting effective penetration tests,
but also for developing secure applications
right from the start.