OWASP

OWASP (Open Web Application Security Project) is a nonprofit organization that publishes the Top 10 Web vulnerability list and security practice guides; it is an authority on Web security.

Purpose

To provide open-source knowledge, tools, and standards for Web application security, helping developers build secure applications.

Mechanism

The OWASP Top 10 is periodically updated with the most severe Web vulnerabilities (injection, XSS, misconfiguration, etc.). It also publishes the Cheat Sheet series, ASVS (Application Security Verification Standard), and ZAP (scanner tool). Community-driven, non-commercial.

Use cases

Web security development reference
Security audit and assessment
Security training
Compliance mapping

Examples

Input

OWASP Top 10:2021

Output

A01 Broken Access Control etc.

10 vulnerability classes

Common errors

Checking only against the Top 10 while ignoring other vulnerabilities: Treat the Top 10 as a starting point; use ASVS for full assessment

Related terms

XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.

CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site.

SQL injection is attackers splicing malicious SQL fragments into a query string so the database executes unintended commands.

CVE (Common Vulnerabilities and Exposures) is a system that assigns unique identifiers (CVE-YYYY-NNNN) to publicly disclosed security vulnerabilities, maintained by MITRE.

CVSS (Common Vulnerability Scoring System) is a standardized scoring system for vulnerability severity, outputting 0-10 scores and maintained by FIRST.

References