Understanding OWASP Top 10: A Beginner's Guide to Web Security

Introduction

As a cybersecurity student actively practicing on PortSwigger Web Security Academy and participating in CTF competitions, I've learned that understanding the OWASP Top 10 is fundamental to web application security. This guide breaks down each vulnerability with practical examples and prevention techniques.

What is OWASP Top 10?

The Open Web Application Security Project (OWASP) Top 10 is a standard awareness document representing a broad consensus about the most critical security risks to web applications. It's updated every few years based on data from security organizations worldwide.

The current OWASP Top 10 (2021) includes:

Broken Access Control
Cryptographic Failures
Injection
Insecure Design
Security Misconfiguration
Vulnerable and Outdated Components
Identification and Authentication Failures
Software and Data Integrity Failures
Security Logging and Monitoring Failures
Server-Side Request Forgery (SSRF)

Let's dive deep into each one!

1. Broken Access Control

What is it?

Access control enforces policies such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of data.

Common Vulnerabilities

IDOR (Insecure Direct Object Reference)

# Vulnerable URL
https://example.com/profile?user_id=1234

# Attacker changes the ID
https://example.com/profile?user_id=1235

Path Traversal

# Vulnerable file access
https://example.com/download?file=invoice.pdf

# Attacker accesses sensitive files
https://example.com/download?file=../../../etc/passwd

Real-World Example

// Vulnerable Code
<?php
$user_id = $_GET['id'];
$query = "SELECT * FROM users WHERE id = $user_id";
$result = mysqli_query($conn, $query);
// Display user data without checking if current user has permission
?>

Prevention

// Secure Code
<?php
session_start();
$requested_user_id = $_GET['id'];
$current_user_id = $_SESSION['user_id'];

// Check if user has permission
if ($requested_user_id != $current_user_id && !is_admin($current_user_id)) {
    die("Access Denied");
}

$query = "SELECT * FROM users WHERE id = ?";
$stmt = $conn->prepare($query);
$stmt->bind_param("i", $requested_user_id);
$stmt->execute();
?>

Key Takeaways

✅ Implement proper authorization checks
✅ Use role-based access control (RBAC)
✅ Deny by default
✅ Log access control failures

2. Cryptographic Failures

What is it?

Previously known as "Sensitive Data Exposure," this category focuses on failures related to cryptography (or lack thereof), which often leads to exposure of sensitive data.

Common Issues

Transmitting data in clear text (HTTP instead of HTTPS)
Using weak or outdated cryptographic algorithms (MD5, SHA1)
Storing passwords without proper hashing
Weak encryption keys

Real-World Example

# Vulnerable Code - Plain text password storage
def register_user(username, password):
    query = f"INSERT INTO users (username, password) VALUES ('{username}', '{password}')"
    db.execute(query)

Prevention

# Secure Code - Proper password hashing
import bcrypt

def register_user(username, password):
    # Hash password with bcrypt (includes salt automatically)
    hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt(rounds=12))
    
    query = "INSERT INTO users (username, password_hash) VALUES (?, ?)"
    db.execute(query, (username, hashed))

def verify_password(username, password):
    stored_hash = db.get_password_hash(username)
    return bcrypt.checkpw(password.encode('utf-8'), stored_hash)

Key Takeaways

✅ Always use HTTPS
✅ Use strong, modern encryption algorithms
✅ Hash passwords with bcrypt, Argon2, or PBKDF2
✅ Never store sensitive data unnecessarily

3. Injection

What is it?

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. The most common types are SQL Injection, NoSQL Injection, and Command Injection.

SQL Injection

Vulnerable Example

// Vulnerable to SQL Injection
$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";

Attack

Username: admin'--
Password: anything

Resulting Query:
SELECT * FROM users WHERE username='admin'--' AND password='anything'

Prevention

// Use Prepared Statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username=? AND password=?");
$stmt->bind_param("ss", $username, $password_hash);
$stmt->execute();

Command Injection

Vulnerable Example

# Vulnerable to Command Injection
import os
ip = request.form['ip']
os.system(f"ping -c 4 {ip}")

Attack

IP: 127.0.0.1; cat /etc/passwd

Prevention

# Use subprocess with list arguments
import subprocess
ip = request.form['ip']

# Validate IP address
if not is_valid_ip(ip):
    return "Invalid IP"

# Use list to prevent injection
subprocess.run(["ping", "-c", "4", ip], capture_output=True)

Key Takeaways

✅ Use parameterized queries (prepared statements)
✅ Validate and sanitize all user input
✅ Use ORM frameworks when possible
✅ Implement least privilege for database accounts

4. Insecure Design

What is it?

Insecure design represents missing or ineffective control design. It's different from insecure implementation - you can't fix insecure design with a perfect implementation.

Examples

No rate limiting on password reset
- Allows brute force attacks
- Enables account enumeration
Predictable session tokens
- Sequential IDs: session_1, session_2, session_3
- Timestamp-based tokens
Missing security requirements
- No multi-factor authentication
- No account lockout mechanism

Prevention

# Implement rate limiting
from flask_limiter import Limiter

limiter = Limiter(app, key_func=get_remote_address)

@app.route("/login", methods=["POST"])
@limiter.limit("5 per minute")
def login():
    # Login logic
    pass

# Use secure random tokens
import secrets

def generate_session_token():
    return secrets.token_urlsafe(32)

Key Takeaways

✅ Use threat modeling during design phase
✅ Implement security requirements from the start
✅ Use secure design patterns
✅ Conduct security reviews before implementation

5. Security Misconfiguration

What is it?

Security misconfiguration is the most common vulnerability, often resulting from insecure default configurations, incomplete setups, or verbose error messages.

Common Issues

Default credentials (admin/admin)
Directory listing enabled
Detailed error messages exposing system information
Unnecessary features enabled
Missing security headers

Example - Missing Security Headers

# Add security headers
from flask import Flask, make_response

@app.after_request
def add_security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    return response

Key Takeaways

✅ Remove default accounts and passwords
✅ Disable unnecessary features and services
✅ Implement proper error handling
✅ Keep software updated
✅ Use security headers

6. Vulnerable and Outdated Components

What is it?

Using components with known vulnerabilities, such as libraries, frameworks, and other software modules that run with the same privileges as the application.

Real-World Impact

Equifax Breach (2017): Unpatched Apache Struts vulnerability
Log4Shell (2021): Log4j vulnerability affecting millions

Prevention

# Regularly check for vulnerabilities
npm audit
pip-audit
snyk test

# Keep dependencies updated
npm update
pip install --upgrade package_name

# Use dependency scanning in CI/CD

Key Takeaways

✅ Maintain an inventory of components
✅ Monitor for security bulletins
✅ Remove unused dependencies
✅ Only obtain components from official sources
✅ Use automated vulnerability scanning

7. Identification and Authentication Failures

What is it?

Previously known as "Broken Authentication," this includes any vulnerability that allows attackers to compromise passwords, keys, or session tokens.

Common Vulnerabilities

Weak Password Policy

# Weak - No password requirements
def is_valid_password(password):
    return len(password) >= 6

# Strong - Enforce complexity
import re

def is_valid_password(password):
    if len(password) < 12:
        return False
    if not re.search(r'[A-Z]', password):
        return False
    if not re.search(r'[a-z]', password):
        return False
    if not re.search(r'[0-9]', password):
        return False
    if not re.search(r'[!@#$%^&*]', password):
        return False
    return True

Session Fixation

# Vulnerable - Reusing session ID after login
@app.route('/login', methods=['POST'])
def login():
    if verify_credentials(username, password):
        session['user_id'] = user.id  # Same session ID
        return redirect('/dashboard')

# Secure - Regenerate session ID after login
@app.route('/login', methods=['POST'])
def login():
    if verify_credentials(username, password):
        session.clear()  # Clear old session
        session.regenerate()  # New session ID
        session['user_id'] = user.id
        return redirect('/dashboard')

Key Takeaways

✅ Implement multi-factor authentication
✅ Use strong password policies
✅ Implement account lockout mechanisms
✅ Regenerate session IDs after login
✅ Use secure session management

8. Software and Data Integrity Failures

What is it?

This relates to code and infrastructure that does not protect against integrity violations, such as using plugins from untrusted sources or insecure CI/CD pipelines.

Examples

Unsigned software updates
Insecure deserialization
Compromised CI/CD pipeline

Insecure Deserialization Example

# Vulnerable - Pickle deserialization
import pickle

def load_user_data(data):
    return pickle.loads(data)  # Dangerous!

# Secure - Use JSON instead
import json

def load_user_data(data):
    return json.loads(data)

Key Takeaways

✅ Use digital signatures for software updates
✅ Verify integrity of libraries and dependencies
✅ Secure your CI/CD pipeline
✅ Avoid insecure deserialization

9. Security Logging and Monitoring Failures

What is it?

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to persist in systems undetected.

What to Log

import logging

# Configure logging
logging.basicConfig(
    filename='security.log',
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s'
)

# Log security events
@app.route('/login', methods=['POST'])
def login():
    username = request.form['username']
    
    if verify_credentials(username, password):
        logging.info(f"Successful login: {username} from {request.remote_addr}")
        return redirect('/dashboard')
    else:
        logging.warning(f"Failed login attempt: {username} from {request.remote_addr}")
        return "Invalid credentials", 401

Key Takeaways

✅ Log all authentication events
✅ Log access control failures
✅ Monitor for suspicious patterns
✅ Implement alerting for critical events
✅ Protect log integrity

10. Server-Side Request Forgery (SSRF)

What is it?

SSRF flaws occur when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to coerce the application to send requests to unintended destinations.

Vulnerable Example

# Vulnerable to SSRF
import requests

@app.route('/fetch')
def fetch_url():
    url = request.args.get('url')
    response = requests.get(url)  # Dangerous!
    return response.content

Attack

# Access internal services
/fetch?url=http://localhost:8080/admin

# Access cloud metadata
/fetch?url=http://169.254.169.254/latest/meta-data/

Prevention

# Secure implementation
import requests
from urllib.parse import urlparse

ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com']

@app.route('/fetch')
def fetch_url():
    url = request.args.get('url')
    
    # Parse and validate URL
    parsed = urlparse(url)
    
    # Check protocol
    if parsed.scheme not in ['http', 'https']:
        return "Invalid protocol", 400
    
    # Check domain whitelist
    if parsed.netloc not in ALLOWED_DOMAINS:
        return "Domain not allowed", 403
    
    # Prevent access to private IPs
    if is_private_ip(parsed.netloc):
        return "Private IPs not allowed", 403
    
    response = requests.get(url, timeout=5)
    return response.content

Key Takeaways

✅ Validate and sanitize all user-supplied URLs
✅ Use whitelist of allowed domains
✅ Disable HTTP redirections
✅ Block access to private IP ranges

Practical Tips for Learning Web Security

1. Practice Platforms

PortSwigger Web Security Academy (My favorite!)
TryHackMe
HackTheBox
OWASP WebGoat
DVWA (Damn Vulnerable Web Application)

2. Essential Tools

Burp Suite - Web application security testing
OWASP ZAP - Open-source alternative to Burp
Postman - API testing
Browser DevTools - Built-in browser tools
curl - Command-line HTTP client

3. Learning Path

Start with OWASP Top 10 basics
Practice on vulnerable applications
Participate in CTF competitions
Read security blogs and writeups
Build your own vulnerable apps to understand flaws
Learn secure coding practices

4. Resources

OWASP Official Documentation
PortSwigger Research Blog
HackerOne Disclosed Reports
Security YouTube Channels (IppSec, LiveOverflow, John Hammond)
Books: "The Web Application Hacker's Handbook", "OWASP Testing Guide"

Conclusion

Understanding the OWASP Top 10 is crucial for anyone interested in web security, whether you're a developer, security professional, or student. These vulnerabilities represent the most critical risks to web applications, and knowing how to identify and prevent them is essential.

Key Principles

Never Trust User Input - Always validate and sanitize
Defense in Depth - Multiple layers of security
Principle of Least Privilege - Minimal necessary permissions
Fail Securely - Errors should not expose sensitive information
Keep Security Simple - Complex security is hard to maintain

My Journey

As a CSE (IoT & Cybersecurity) student, I've been actively learning web security through:

PortSwigger Web Security Academy labs
CTF competitions (1st place at SIES GST!)
Building security-focused projects
Practicing on TryHackMe

The key is consistent practice and hands-on experience. Reading about vulnerabilities is important, but actually exploiting them (ethically!) in a lab environment is where real learning happens.

Next Steps

Set up a lab environment - Install DVWA or WebGoat
Complete PortSwigger Academy - Free and excellent resource
Join CTF competitions - Practice under pressure
Build secure applications - Apply what you learn
Stay updated - Follow security news and blogs

Remember: With great power comes great responsibility. Always practice ethical hacking and never test on systems you don't own or have permission to test.

Happy learning, and stay secure! 🔐

Author: Devanshu Bansode
Contact: devanshu.bansode06@gmail.com
GitHub: DevanshuHB

If you found this guide helpful, feel free to share it with others learning web security!