Skip to content

Module 03: Web Application Security

← Module 02: Networking for Security | Topic Home | Next: SQL Injection →

Status Difficulty Time

The OWASP Top 10 is the security industry's consensus on the most critical web application risks — mastering these 10 categories means understanding the attack patterns behind 90% of web vulnerability classes.

[!NOTE] Stub Module — Full theory content will be expanded in a future update.

Table of Contents

  1. Overview
  2. Prerequisites
  3. Objectives
  4. Theory
  5. Key Concepts
  6. Examples
  7. Common Pitfalls
  8. Cross-Links
  9. Summary

Overview

Web applications are the primary attack surface of the modern internet. They are externally accessible, complex, and built rapidly under business pressure — an environment that produces vulnerabilities. The OWASP (Open Web Application Security Project) Top 10 is the industry's consensus list of the most critical web application security risks, based on data from thousands of real-world applications.

This module provides a comprehensive introduction to all 10 categories. Subsequent modules (04–06) go deep on three of the most impactful: injection (SQL injection), client-side attacks (XSS), and access control (broken access control/IDOR). Module 08 introduces the tools (Burp Suite, Metasploit) for systematic testing.

Understanding the OWASP Top 10 is not just about knowing what they are — it is about understanding why each vulnerability exists (what design or implementation decision created it), how it is exploited, and how it is prevented. The defensive perspective is as important as the offensive one for any professional practitioner.

Prerequisites

  • [[pentesting-security/modules/01_introduction]] — Ethics, legal framework, lab setup
  • [[pentesting-security/modules/02_networking-for-security]] — HTTP protocol understanding
  • Basic understanding of HTML and how web applications work (forms, parameters, cookies)

Objectives

By the end of this module, you will be able to:

  1. Describe all 10 categories in the OWASP Top 10 (2021) and give an example of each
  2. Explain why each vulnerability exists (the root cause design or implementation flaw)
  3. Identify potential vulnerability indicators in a web application using manual exploration
  4. Use Burp Suite Proxy to intercept and inspect HTTP requests and responses
  5. Apply the OWASP Testing Guide methodology to a web application
  6. Describe the defensive control that prevents each OWASP Top 10 category

Theory

The OWASP Top 10 (2021)

The OWASP Top 10 represents the consensus of security experts worldwide on the most critical web application vulnerabilities. The 2021 version was compiled from data contributed by over 40 partner organizations covering hundreds of thousands of applications.

A01: Broken Access Control (moved up from #5 to #1) — Users can act outside their intended permissions. Examples: accessing other users' data by changing an ID parameter (IDOR), accessing admin functions without admin privileges, missing function-level access control. Prevention: server-side authorization checks on every request; deny by default; minimize CORS exposure.

A02: Cryptographic Failures (formerly "Sensitive Data Exposure") — Sensitive data is exposed due to weak or missing cryptography. Examples: passwords stored in MD5 or unsalted hashes, data transmitted over HTTP, weak cipher suites in TLS. Prevention: use bcrypt/scrypt/argon2 for passwords; enforce HTTPS everywhere; use TLS 1.2+ with strong cipher suites.

A03: Injection — Untrusted data is sent to an interpreter (SQL, OS, LDAP, etc.) and executed as code. SQL injection is the canonical example. Prevention: parameterized queries; ORMs with proper escaping; input validation; least privilege on database accounts.

A04: Insecure Design — Security was not designed in from the start. This category represents architectural and design flaws rather than implementation bugs. Examples: missing rate limiting, lack of multi-factor authentication, insecure password reset flows. Prevention: threat modeling during design; security requirements definition; secure design patterns.

A05: Security Misconfiguration — Insecure default configurations, unnecessary features enabled, verbose error messages, default credentials. Examples: S3 buckets with public read, default admin/admin credentials, directory listing enabled, detailed error stack traces exposed. Prevention: hardening guides; automated configuration scanning; disable unused features.

A06: Vulnerable and Outdated Components — Using components (libraries, frameworks, platforms) with known vulnerabilities. Log4Shell (CVE-2021-44228) is the canonical modern example. Prevention: software composition analysis (SCA) tools; automated dependency scanning; patch management process.

A07: Identification and Authentication Failures (formerly "Broken Authentication") — Weaknesses in authentication and session management. Examples: weak password policies, missing brute force protection, session tokens in URLs, predictable session IDs. Prevention: strong password policy; MFA; secure session management (HttpOnly/Secure cookies, random IDs).

A08: Software and Data Integrity Failures — Code and infrastructure that does not protect against integrity violations. Examples: insecure deserialization, unsigned software updates, CI/CD pipeline compromise. Prevention: code signing; verify integrity of dependencies; secure deserialization practices.

A09: Security Logging and Monitoring Failures — Insufficient logging prevents detection and response. Examples: no alerting on repeated failed logins, no audit trail for sensitive operations, logs not monitored. Prevention: comprehensive security event logging; SIEM integration; incident response procedures.

A10: Server-Side Request Forgery (SSRF) — The server makes HTTP requests on behalf of the attacker. Examples: fetching http://169.254.169.254/ (AWS metadata endpoint) via a user-supplied URL parameter, scanning internal services via the server. Prevention: allowlist-based URL validation; disable HTTP redirects in outbound requests; network egress filtering.

Burp Suite Community Edition — Basic Workflow

Burp Suite is the standard tool for web application security testing. The Community Edition (free) provides the core proxy, interceptor, repeater, and decoder — all you need for manual testing.

SETUP WORKFLOW:
1. Start Burp Suite → Proxy → Intercept (ensure "Intercept is on")
2. Configure your browser to use Burp's proxy:
   - Host: 127.0.0.1 / Port: 8080
   - Install Burp's CA certificate in your browser
3. Navigate to your target (DVWA at http://localhost)
4. All HTTP/HTTPS traffic now flows through Burp
5. In the Proxy > HTTP history tab, you can see every request
6. Right-click any request → "Send to Repeater" to manually test it

# Example: Using Python requests to send a modified HTTP request
# (equivalent to what Burp Repeater does graphically)
import requests

# Target: DVWA login page (local, authorized)
target = "http://localhost/login.php"

# Normal login attempt
response = requests.post(target, data={
    "username": "admin",
    "password": "password",
    "Login": "Login"
}, allow_redirects=False)

print(f"Status: {response.status_code}")
print(f"Location: {response.headers.get('Location', 'None')}")
# If login succeeds, expect 302 redirect to index.php

Key Concepts

OWASP — Open Web Application Security Project, a nonprofit that produces free security guidance. Their Top 10, Testing Guide, ASVS (Application Security Verification Standard), and Cheat Sheet Series are industry standards.

Attack Vector — How an attacker reaches the vulnerable component. In web applications: network (any internet user can reach it), adjacent (same network required), local (requires login), physical (requires physical access). Most web vulnerabilities have a "network" attack vector — the highest severity.

Input Validation vs. Output Encoding — Two distinct but complementary defenses. Input validation rejects malformed or unexpected input before it enters the system. Output encoding transforms data before rendering so that special characters cannot be interpreted as code (prevents XSS). Both are needed; neither alone is sufficient.

Defense in Depth — Layering multiple independent security controls so that no single failure leads to a breach. For web applications: WAF + input validation + parameterized queries + least privilege + logging. If the WAF is bypassed, the parameterized query still prevents SQL injection.

Examples

Example 1: OWASP Top 10 Applied to DVWA

DVWA has a module for each major vulnerability class. Set security level to "Low" and navigate to each section. For each module in DVWA, you can verify which OWASP Top 10 category it represents:

DVWA Module → OWASP Top 10 Category
Brute Force → A07: Authentication Failures
Command Injection → A03: Injection
CSRF → A01: Broken Access Control
File Inclusion → A05: Security Misconfiguration / A03: Injection
File Upload → A05: Security Misconfiguration
Insecure CAPTCHA → A04: Insecure Design
SQL Injection → A03: Injection
SQL Injection (Blind) → A03: Injection
Weak Session IDs → A07: Authentication Failures
XSS (DOM) → A03: Injection (client-side)
XSS (Reflected) → A03: Injection (client-side)
XSS (Stored) → A03: Injection (client-side)

Common Pitfalls

Pitfall 1: Treating the OWASP Top 10 as a complete checklist. The Top 10 covers the most common, not the only, web vulnerabilities. Business logic vulnerabilities, rate limiting issues, and cryptographic implementation flaws may not fit neatly into any single Top 10 category.

Pitfall 2: Testing authentication without authorization. Brute force and credential stuffing attacks against real systems are harmful even in a "security research" context — they can lock out legitimate users. Always ensure this testing is explicitly authorized and off-hours.

Pitfall 3: Confusing input validation with output encoding. Input validation prevents bad data from entering the system. Output encoding prevents data from being interpreted as code when rendered. SQLi needs parameterized queries. XSS needs output encoding. They are not the same control.

  • [[pentesting-security/modules/04_sql-injection]] — Deep dive into OWASP A03 (Injection) specifically for SQL
  • [[pentesting-security/modules/05_xss-and-client-side]] — Deep dive into client-side injection (XSS, CSRF)
  • [[pentesting-security/modules/06_broken-access-control]] — Deep dive into OWASP A01

Summary

  • The OWASP Top 10 (2021) categorizes the most critical web application security risks
  • A01 (Broken Access Control) is #1 because missing authorization checks are widespread and impactful
  • Every OWASP category has a root cause (design or implementation) and a corresponding defensive control
  • Burp Suite Proxy intercepts HTTP/HTTPS traffic, enabling manual inspection and testing
  • DVWA provides a legal practice environment with examples of most OWASP Top 10 categories
  • Input validation and output encoding are complementary and both necessary defenses