owasp-top-10

OWASP Top 10 (2021)

Comprehensive knowledge base covering all ten OWASP categories with vulnerability patterns, detection techniques, code examples, and framework-specific mitigations.

Knowledge Base

A01:2021 - Broken Access Control

Moved from #5 to #1. 94% of applications tested had some form of broken access control. This category covers failures in enforcing that users cannot act outside their intended permissions.

Vulnerability Patterns:

• IDOR (Insecure Direct Object Reference): Accessing resources by manipulating identifiers. GET /api/users/1234/profile where changing 1234 to 1235 returns another user's data without ownership check.
• Missing function-level access control: Admin endpoints accessible to regular users. No middleware/decorator enforcing role checks on sensitive routes.
• Path traversal: GET /files?name=../../../etc/passwd -- file operations using user-supplied paths without canonicalization and validation.
• CORS misconfiguration: Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true, or reflecting the Origin header without validation.
• JWT manipulation: Changing alg to none, substituting HMAC for RSA keys, modifying claims without signature verification.
• Forced browsing: Accessing admin pages, backup files, or API documentation that isn't linked but exists on the server.

Detection in Code:

# VULNERABLE: No ownership check
@app.route('/api/orders/<order_id>')
def get_order(order_id):
    return Order.query.get(order_id).to_json()

# FIXED: Verify the order belongs to the current user
@app.route('/api/orders/<order_id>')
@login_required
def get_order(order_id):
    order = Order.query.get_or_404(order_id)
    if order.user_id != current_user.id:
        abort(403)
    return order.to_json()

A02:2021 - Cryptographic Failures

Previously "Sensitive Data Exposure." Focuses on failures related to cryptography that lead to exposure of sensitive data.