Ravindra BagaleCourses & study guides मराठी Track your progress

29. OWASP Top 10 Web Vulnerabilities

By Last updated:

Chala mitrano, aata Part 11 – khara ethical hacking course. Suruvat sarvat mahatvachya yaadine: OWASP Top 10. He jagatlya sarvat dhokadayak web application vulnerabilities aahet, OWASP naavachya sansthene tharavlelya. Tumhi Chapter 9 te 16 madhe swatah web app banavla – aata tya app madhe he bugs kase yetat, attacker kase vaparto, ani sarvat mahatvacha, te kase fix karaycha he shiku. Pratyek attack DVWA/Juice Shop var karun, mag fix code madhe. Sagle fakt tumchya lab var. Samjla ka? Chala!

What you will learn in this chapter

  • What OWASP and the Top 10 are
  • Each of the 2021 Top 10 categories: what it is, a lab, and the fix
  • SQL injection, XSS, CSRF, broken access control/IDOR, file upload, command injection, SSRF and misconfiguration in depth
  • How the fixes map to the code you wrote in Chapters 9–16
  • Secure-coding habits you can apply immediately

Lab scope for this whole chapter

Run every attack only against DVWA, OWASP Juice Shop, or your own reels app from Chapter 16, on the host-only lab. Testing these on any site you do not own is a crime under the IT Act.

Concepts in this chapter

  1. 29.1What OWASP and the Top 10 Are
  2. 29.2A03 Injection: SQL Injection
  3. 29.3A03 Injection: Cross-Site Scripting (XSS)
  4. 29.4A03 Injection: Command Injection
  5. 29.5A01 Broken Access Control and IDOR
  6. 29.6A07 Authentication and A02 Cryptographic Failures
  7. 29.7The Rest: Design, Components, Integrity, Logging, SSRF
  8. 29.8Red vs Blue, Project and Real Incidents
  9. 29.9Threat Modelling (STRIDE)

The chapter recap is at the end of the last concept page.

Chapter 29: OWASP Top 10 — practice tasks

Open chapter lessons · Full guided lab: fix sql query parameterised training app (not repeated here)

29.1 Fix a reflected XSS

MediumRetail

Why: XSS steals sessions in the browser.

What: Build a vulnerable page, then escape output.

How:

  1. PHP: echo $_GET['q'] → open ?q=<script>alert(1)</script>.
  2. Change to htmlspecialchars($_GET['q']??'', ENT_QUOTES).

Expected output: Before: alert runs. After: tags shown as text.

Hint

Same idea in Node templates and Java c:out.

Answer / how to check
  1. View-source shows &lt;script&gt;.

29.2 Broken access control demo

MediumBanking

Why: Changing an ID in the URL must not show another user's data.

What: Make /invoice?id=1 and /invoice?id=2; log in as user1.

How:

  1. Return invoice only if session.user_id matches.
  2. Try id=2 as user1.

Expected output: 403 or empty for id=2.

Hint

Never trust IDs from the client alone.

Answer / how to check
  1. user1 cannot see user2's invoice.

29.3 Security misconfiguration checklist

EasyHealthcare

Why: Defaults and debug pages cause breaches.

What: Audit your local app with the checklist.

Data file: misconfig.csv

Check
Debug/display_errors Off
No default admin/admin
Directory listing Off
No stack traces to users

About this file: Checklist. Each row is one check to perform on your lab app.

How:

  1. Check: debug off, default passwords gone, directory listing off, stack traces hidden.

Expected output: All four items Yes.

Hint

curl / and a missing page to confirm.

Answer / how to check
  1. Write Yes/No for each item.

Extended teaching notes

Why this lesson matters

Part 11 turns tool skills into professional defensive practice: web risks, cloud, SOC work, hardening, cryptography, Indian law and careers. Every example below stays inside systems you own or public teaching material.

Indian company (sample data)

Suppose we are a junior security engineer at an Infosys or TCS client project. You take this lesson's checklist, map it to three production services (for example a Spring Boot API, a Node.js portal and a Python job), and open tickets with evidence and owners.

Global practice

Follow public guidance from OWASP, CERT-In, CISA and cloud provider Well-Architected / security pillars. Cite them in reports.

Everyday analogy

A cricket team that only practises hitting but never fielding loses matches. Offence skills in a lab exist to improve fielding in real systems.

Apply across stacks

Wherever code appears, ask the same questions.

Java / Spring Boot

Parameterise queries, encode output, limit Actuator, patch dependencies.

.NET

EF Core parameters, HTTPS, Data Protection API, patch NuGet.

Node.js

helmet, parameterized SQL, npm audit, lockfiles.

Python

ORM, autoescape, pip-audit, Bandit.

Go / PHP / Ruby

Safe templates, prepared statements, govulncheck / composer audit / Brakeman.

nginx / Apache / Tomcat

Hide versions, TLS, least-open ports.

MySQL / PostgreSQL / MongoDB / Redis

No public ports, auth on, least-privilege users.

AWS / Azure / GCP

Roles not keys, private data stores, cloud logs on.

Defender worksheet

  1. Write a 5-line summary.
  2. Name one related public breach or advisory.
  3. Practise one safe command on a lab you own.
  4. Write the fix for a teammate.

Recap

  • Permission first.
  • Fix over spectacle.
  • Evidence in notes.

Defender's worksheet (do this today)

  1. Write the lesson title and date.
  2. List three owned systems where it applies.
  3. Run one safe lab check and paste evidence.
  4. Write a two-sentence fix for a teammate.
  5. Note one CERT-In or CISA advisory that relates (title + date).

Indian workplace (sample)

At a Wipro or LTIMindtree client SOC, turn this lesson into one playbook step with an owner and a due date.

Global practice

Compare your notes with OWASP, CIS Benchmarks or a cloud Well-Architected security question. Write the overlap in five lines.

Family test

Explain the risk and the fix without jargon. If a parent or sibling can repeat the warning, you are ready to teach juniors.

Common mistakes

  • Skipping permission.
  • Tool collecting without fixing.
  • Publishing lab screenshots that contain secrets.
  • Treating encoding as encryption.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.

Key terms for this page

  • Control: a safeguard (patch, config, process).
  • Finding: a weakness with evidence.
  • Remediation: the fix and how you verified it.
  • Scope: systems you are allowed to touch.
  • Least privilege: only the access required for the task.
  • Defence in depth: several controls in layers.

Mini case study

Suppose we are a junior engineer at Zoho or Freshworks (sample data). A weekly review asks each person to present one control from their area. You pick a control from this lesson, show a before/after screenshot from a lab, and list the production ticket you would open. That habit builds both skill and credibility.