OWASP Top 10 in 10 Min! (Kinda)

### Overview In this talk, security researcher and Hadrian VP of Research and Community Ben Sadeghipour (nahamsec) provides an accessible, rapid walkthrough of the OWASP Top 10 (2021 edition). Drawing from his background educating non-technical team members and working in bug bounty, he breaks down each vulnerability category, sharing practical explanations, common exploitation scenarios, and relevance to bug bounty hunters.

### Key Topics The presentation centers on the ten categories defining the OWASP Top 10 (2021): - **A01: Broken Access Control**: Gaining unauthorized access to data or functionality that belongs to another user or role (e.g., viewing other employees' salaries or PII via Insecure Direct Object References (IDOR), API parameter fuzzing, or tampering with JSON cookies and JWT tokens). - **A02: Cryptographic Failures**: Failures in protecting data in transit or at rest, such as sending cleartext data, lacking proper HTTP headers, or failing to use HTTPS. - **A03: Injection**: Flaws allowing execution of arbitrary code or queries, grouping server-side execution (SQL injection, remote code execution/command injection) and client-side execution (cross-site scripting / XSS, XXE). - **A04: Insecure Design**: A category introduced in 2021 focusing on flaws in business logic rather than pure implementation vulnerabilities, such as bypassing item quantity limits or tampering with prices and coupons. - **A05: Security Misconfiguration**: Leaving exposed debug or unnecessary functionality, unneeded open ports, default files, or default/guessable credentials on deployed applications (e.g., Apache Tomcat defaults). - **A06: Vulnerable and Outdated Components**: Exploiting known vulnerabilities or zero-days in widely used platforms (such as Apache Struts 2, Heartbleed, Jira, GitHub Enterprise, Jenkins, or Grafana) using public proofs of concept. - **A07: Identification and Authentication Failures**: Compromising user accounts via brute-forcing passwords, credential stuffing against breaches, session fixation, token exposure in URL bars, or session reuse. - **A08: Software and Data Integrity Failures**: Risks stemming from untrusted code, unverified software updates, dependency confusion (highlighting research by Alex Birsan), or CI/CD pipeline tampering, illustrated by the SolarWinds supply chain attack. - **A09: Security Logging and Monitoring Failures**: Inability to detect attacks or malicious activity in real-time due to absent logging for failed logins or server traffic. - **A10: Server-Side Request Forgery (SSRF)**: Tricking the server into generating unintended network requests, enabling attackers to interact with internal infrastructure, query cloud metadata services (e.g., AWS keys), bypass firewalls/VPN boundaries, or read local files.

### Technical Details The speaker highlights various testing approaches and tools throughout the talk: - **Fuzzing and Exploitation**: Mentioning tools like `ffuf` and `wfuzz` for finding API endpoints and brute-forcing parameters, and `nuclei` for scanning outdated components. - **Logic Attacks**: Evaluating whether an application's business rules can be inverted or broken (e.g., ordering 150 units of an item limited to 15, or manipulating $29.99 pricing down to $0.99). - **SSRF Exploits**: Leveraging internal network access from vulnerable apps to reach cloud provider metadata services (such as AWS/Azure), internal APIs, or internal web consoles.

### Takeaways For newcomers and bug bounty hunters seeking hands-on practice, the speaker recommends OWASP Juice Shop (available as a Docker image), Hack The Box retired machines, and TryHackMe dedicated rooms. While noting structural differences and personal preferences favoring the 2017 list, the speaker emphasizes that the OWASP Top 10 remains an essential framework for identifying critical vulnerabilities and understanding web application security risks.