OWASP Top 10
Overview
The OWASP Top 10 is a widely used awareness document describing the major security risks affecting web applications.
Key concepts
- Broken access control, cryptographic failures, injection
- Insecure design, misconfiguration, vulnerable components
- Auth failures, integrity failures, logging failures, SSRF
How it works
The OWASP Top 10 is a widely used awareness document describing the major security risks affecting web applications — the standard reference point for nearly every other topic in this section.
| Risk | What it means |
|---|---|
| Broken access control | Lets users access data, features, or actions they shouldn't be allowed to use. |
| Cryptographic failures | Missing, weak, or incorrect encryption that can expose sensitive data. |
| Injection | Untrusted input is interpreted as a command, query, or instruction. |
| Insecure design | Security weaknesses from poor planning, missing controls, or unsafe design decisions. |
| Security misconfiguration | Insecure settings, default accounts, excess permissions, or unnecessary features. |
| Vulnerable components | Third-party libraries, frameworks, plugins, or software versions with known flaws. |
| Identification & authentication failures | Weaknesses in login, password, session, or identity-verification processes. |
| Software & data integrity failures | Allowing untrusted or modified software, updates, or data to be used. |
| Security logging & monitoring failures | Missing or insufficient logs/alerts/monitoring, making attacks harder to detect. |
| Server-side request forgery (SSRF) | Lets an attacker make a server send requests to unintended internal or external systems. |