OWASP Top 10 Vulnerabilities Cheatsheet

9 min readAug 3, 2023

In today’s digital world, software and web applications are everywhere. But with convenience comes risks. Cyber attackers are always looking for weak points to exploit. That’s where the OWASP Top 10 vulnerabilities come in — a list that shows common security risks web apps face. In this article, we’ll explore these vulnerabilities using real-life examples to understand them better.

Let’s get ready to navigate the OWASP Top 10 cheatsheet and protect our digital world!

1. Broken Access Control

Imagine a big, fancy library with many restricted sections that only certain people, like librarians, can access. However, one day, a clever thief sneaks into the library unnoticed. The thief discovered that some hidden doors are not properly locked and can be opened without a key or permission. Once inside, the thief gains access to valuable and secret books, reading sensitive information they weren’t supposed to see. This is what happens when a web application doesn’t set proper restrictions, and unauthorized users can access sensitive parts of the system, leading to data breaches and unauthorized access.

Code example: Directly accessing an admin page without proper authentication.

# URL meant for privileged users (admins)
http://example.com/admin-page

# Attacker accesses the admin page without proper authentication
http://example.com/admin-page (without login)

Meaning & Theory: Broken access control occurs when an application does not properly enforce restrictions on what authenticated users can access. It allows unauthorized users to gain access to sensitive resources or perform actions they shouldn’t have permissions for.
Technical Explanation: Web applications typically use session tokens or cookies to authenticate users. If an attacker manipulates these tokens or bypasses the authentication process, they can access privileged functionalities or data.
Example: An attacker intercepts the session token of an authenticated user, modifies it to have admin privileges, and gains unauthorized access to admin functions.
Impact: Attackers can view sensitive information, modify data, or perform administrative actions, compromising the application’s security.

Imagine a museum with a special exhibition room for VIPs. Each VIP has a unique badge to access the room. However, a mischievous child copies a VIP’s badge and gains access to the restricted area. This relates to broken access control because the child bypassed the proper restrictions and accessed the VIP room without permission.

2. Cryptographic Failures

Let’s say you have a top-secret journal that you want to keep safe. Instead of locking it in a secure box, you leave it lying around with no protection whatsoever. Anyone who finds it can easily read all your secrets. Similarly, if a website stores your passwords or sensitive information without proper encryption, attackers can easily steal that information and use it for malicious purposes.

Code example: Storing a password in plain text instead of encrypting it.

# Storing password without encryption (unsafe)
password = "mysecretpassword"

Meaning & Theory: Cryptographic failures occur when encryption, hashing, or other cryptographic functions are implemented incorrectly, leading to weak protection of sensitive data.
Technical Explanation: Weak cryptographic algorithms or poorly managed keys can be exploited by attackers to decrypt encrypted data or forge signatures.
Example: Storing passwords in a database without proper hashing and salting, making it easy for attackers to obtain the original passwords.
Impact: Sensitive data becomes exposed, leading to data breaches and loss of user trust.

Picture a treasure chest with a weak lock that’s easily breakable. Even though the chest is supposed to keep valuables safe, a thief easily picks the lock and steals the treasures. This is similar to cryptographic failures where weak encryption or poor key management allows attackers to steal sensitive data.

3. Injection

Imagine you have a magical notebook that can execute any spell you write in it. But what if someone secretly writes a harmful spell in your notebook? Without you knowing, the notebook performs that dangerous spell, causing chaos. In the same way, if a web application doesn’t properly handle user inputs, attackers can sneak in harmful code, like SQL queries, and execute them on the server, leading to data theft or system compromise.

Code example: Performing an SQL injection attack on a login form.

# Malicious SQL injection
username = "' OR 1=1; --"
password = "' OR 1=1; --"
SELECT * FROM users WHERE username = '' OR 1=1; -- ' AND password = '' OR 1=1; --';

Meaning & Theory: Injection vulnerabilities happen when untrusted data is sent to an interpreter as part of a command or query, allowing attackers to execute arbitrary code.
Technical Explanation: Applications that use dynamic queries without proper input validation and parameterization are susceptible to injection attacks.
Example: An attacker crafts a malicious SQL query that gets executed by the application, allowing unauthorized access to the database.
Impact: Attackers can manipulate data, steal information, or even gain control over the entire system.

In a restaurant, the chef prepares a salad, and a customer sneaks in their own homemade dressing without anyone noticing. The customer’s dressing gets mixed with the restaurant’s salad, causing chaos. Similarly, injection vulnerabilities allow attackers to sneak malicious code into the application, leading to unexpected outcomes.

4. Insecure Design

Picture a castle built without considering any security measures, like having open gates and windows everywhere. It looks grand from the outside, but intruders can easily sneak inside and steal valuable treasures. Similarly, if an application’s design doesn’t take security into account, attackers can exploit its vulnerabilities, leading to data breaches and security problems.

Code example: Lacking proper access controls in a web application.

// Insecure JavaScript code (no access control)
if (userType == "admin") {
    // Perform admin actions
}

Meaning & Theory: Insecure design refers to security weaknesses stemming from flawed application architecture and design decisions.
Technical Explanation: Lack of proper threat modeling, access controls, or separation of duties can lead to unintended exposure of sensitive functionalities or data.
Example: Allowing direct database access from the frontend, making it easy for attackers to perform unauthorized database operations.
Impact: The application becomes vulnerable to attacks, data leakage, and other security issues due to inadequate design choices.

Imagine a maze with open paths that allow people to bypass walls and reach the center directly. The maze is poorly designed, making it easy for anyone to cheat and reach the destination without following the correct path. Similarly, insecure application design provides attackers with easy routes to bypass security measures.

5. Security Misconfiguration

Imagine you bought a high-tech security system for your house, but you forgot to set the alarm or left the doors unlocked. Even with the best security tools, your house is vulnerable due to misconfigurations. Similarly, web applications with incorrect settings or exposed default credentials can become easy targets for attackers.

Code example: Leaving default credentials unchanged in a configuration file.

# Insecure configuration file (default credentials)
database.username=admin
database.password=admin123

Meaning & Theory: Security misconfiguration arises from not applying secure settings or configurations for applications, frameworks, or platforms.
Technical Explanation: Leaving default credentials, exposing unnecessary services, or failing to apply access controls can expose critical resources to attackers.
Example: A server with default credentials allows attackers to log in and gain full control over the system.
Impact: Attackers can exploit misconfigurations to access sensitive data, manipulate systems, or perform unauthorized actions.

You have a fancy safe, but you accidentally leave the door unlocked. Anyone who comes across the safe can open it and take its contents. This is similar to security misconfiguration, where applications or systems are left with default settings or improper configurations, making them vulnerable to attacks.

6. Vulnerable and Outdated Components

Think of an app as a fancy car. If you use old, rusty parts or faulty components, the car becomes unreliable and unsafe. Likewise, if an application uses outdated or vulnerable software components, attackers can exploit those weaknesses to break into the system.

Code example: Using an outdated library with known security vulnerabilities.

// Java code using a vulnerable library
import outdated.library.Version1;

Meaning & Theory: Using outdated or vulnerable software components introduces security risks into the application.
Technical Explanation: Third-party libraries, frameworks, or plugins with known security flaws can be exploited by attackers to compromise the application.
Example: A web application integrates an outdated library with a known Remote Code Execution (RCE) vulnerability, enabling attackers to execute arbitrary code.
Impact: Attackers can exploit vulnerabilities in outdated components, leading to data breaches, system compromise, or unauthorized access.

You have a shiny new bike, but you never replace the old, worn-out tires. As a result, you frequently get flat tires and can’t ride efficiently. This connects to using outdated or vulnerable components in an application, making it susceptible to attacks due to known weaknesses.

7. Identification and Authentication Failures

Suppose you have a secret club with a secret handshake for members to prove their identity. However, the handshake is too simple, and anyone can easily guess it or imitate it. As a result, impostors can gain access to the club. Similarly, weak authentication mechanisms and poor password policies make it easier for attackers to impersonate users and gain unauthorized access.

Code example: Weak password policy in a user registration process.

<!-- Weak password policy -->
<input type="password" name="password" minlength="4" maxlength="8">

Meaning & Theory: Identification and authentication failures relate to weaknesses in user identification and verification mechanisms.
Technical Explanation: Weak password policies, lack of multi-factor authentication, or flawed session management can lead to unauthorized access.
Example: Allowing users to set weak passwords like “123456” or not enforcing password changes periodically.
Impact: Attackers can gain unauthorized access to user accounts, leading to account takeover and potential data breaches.

In a game, a character’s password is a simple word like “password123.” Any player who guesses this password gains control of the character, even if they aren’t the real owner. This illustrates identification and authentication failures, as weak authentication mechanisms allow unauthorized access.

8. Software and Data Integrity Failures

Imagine a restaurant where the chef doesn’t check the ingredients’ quality before using them in dishes. Customers may end up eating spoiled or contaminated food. Similarly, if software updates are not verified for their integrity, attackers can inject malicious code during the update process, leading to compromised systems.

Code example: Lack of code signing in a software update process.

# Insecure software update without verification
sudo apt-get update
sudo apt-get install vulnerable-software

Meaning & Theory: Software and data integrity failures occur when the integrity of software updates, critical data, or continuous integration/continuous deployment (CI/CD) pipelines is compromised.
Technical Explanation: Failing to validate software updates, not using code signing, or allowing unauthorized changes can lead to malicious code injection.
Example: An attacker modifies a software update package to include a backdoor, and users unknowingly install the compromised update.
Impact: Attackers can compromise the system, manipulate data, and execute unauthorized code due to integrity failures.

You order a new phone online, but the delivery person swaps the brand-new phone with a cheap, damaged one before delivering it to you. This is similar to integrity failures where attackers manipulate software or data during transit, leading to compromised systems.

9. Security Logging and Monitoring Failures

Think of a detective investigating a crime scene without any tools to collect evidence or record important details. They would have a hard time solving the case and might miss crucial clues. Similarly, if a system lacks proper logging and monitoring, security incidents may go unnoticed, allowing attackers to continue their activities undetected.

Code example: Inadequate logging of a failed login attempt.

// Incomplete logging
if (loginSuccess) {
    log("Successful login by user: " + username);
}

Meaning & Theory: Security logging and monitoring failures refer to inadequate practices that hinder timely detection and response to security incidents.
Technical Explanation: Insufficient logging, lack of real-time alerts, or not monitoring critical events can make it difficult to identify ongoing attacks.
Example: An application fails to log failed login attempts, making it challenging to identify brute-force attacks on user accounts.
Impact: Attackers can operate undetected for longer periods, leading to prolonged compromise and difficulty in investigating security incidents.

A guard is supposed to watch the entrance of a building, but they fall asleep on the job. An intruder sneaks in, commits a crime, and leaves without anyone noticing. This relates to security logging and monitoring failures, where inadequate monitoring allows attacks to go undetected.

10. Server-Side Request Forgery

Imagine a cunning spy who can pretend to be someone else and access secure areas by tricking the guards. In the same way, an attacker can manipulate a web application into making unauthorized requests to internal or external systems, potentially gaining access to sensitive data and resources.

Code example: Forging a request to access an internal API endpoint.

import requests

# Forged request to access internal API
response = requests.get('http://example.com/internal-api', params={'data': 'sensitive_info'})

Meaning & Theory: Server-Side Request Forgery (SSRF) vulnerabilities allow attackers to make unauthorized requests from the server to other internal or external systems.
Technical Explanation: Web applications often make HTTP requests to other servers. If the application does not properly validate user-supplied URLs, attackers can trick the server into making unintended requests.
Example: An attacker sends a specially crafted URL to a vulnerable application, causing the server to fetch sensitive internal information and relay it back to the attacker.
Impact: Attackers can abuse SSRF to access sensitive resources, bypass firewalls, or retrieve internal data, leading to unauthorized access and potential data leaks.

Imagine a magical genie that can retrieve anything you ask for. But an evil sorcerer tricks the genie into fetching forbidden items from the spirit world, causing chaos. In a similar fashion, server-side request forgery vulnerabilities allow attackers to trick the server into making unauthorized requests, accessing restricted resources.

Understanding security risks doesn’t need to be complicated. By being vigilant and using strong passwords, we can make our digital world safer. Whether we’re developers or tech-savvy users, we all play a part in building a secure digital future. Let’s keep learning and adapting to protect ourselves and others online.

Thank You