OWASP Top-25 Parameters

### Overview In this talk, security researcher Matt introduces the OWASP Top-25 Parameters project, an initiative designed to identify and rank web application parameters that have the highest probability of harboring security vulnerabilities. Matt, a 19-year-old independent researcher from Turkey pursuing a bachelor's degree in Poland and an OWASP Project Leader, shares the history, methodology, and practical applications of the project. He conceptualizes the project using an atomic orbital model analogy: just as an electron cloud shows locations with the highest probability of finding electrons, the project maps out parameters where the likelihood of detecting vulnerabilities within a universal set is highest. These datasets are intended for use by security researchers in fuzz testing, static code analysis, and dynamic analysis.

### Key Topics The presentation centers on three core areas: the sources and data collection methodologies, the vulnerability categories analyzed, and the timeline tracing the project's evolution. Matt began the project in 2021, achieving over 1,500 GitHub stars before it transitioned into an official OWASP Foundation project two years later. Following this milestone, he presented the project at OWASP Global AppSec in Washington, D.C., and HackSEC 2024 in Turkey.

A central topic is the contrast between manual analysis and automation. Unlike many modern datasets that rely exclusively on automated scrapers, Matt collected most of the foundational data manually from articles dating back to 2007, blog posts, write-ups, open-source projects, and public bug bounty reports from platforms like HackerOne and Bugcrowd, referencing vulnerable disclosure programs such as the Netherlands' VDP. The project distinguishes between 'confirmed' data verified manually and unconfirmed data collected via automated pipelines, with plans to synthesize both approaches in future iterations.

### Technical Details The OWASP Top-25 Parameters project provides prioritized parameter rankings across several common web application vulnerability types: - **Cross-Site Scripting (XSS):** Lists top parameters ranging from markers like `email`, `name`, and date fields, capturing high-probability entry points for XSS vulnerabilities. - **SQL Injection (SQLi):** Features ranked primary parameter tables where parameters like `id` carry a significantly higher likelihood of vulnerability compared to parameters like `region`, `main`, or `form`. - **Remote Code Execution (RCE):** Identifies function names, print parameters, and module markers with high likelihood of RCE exposure. - **Local File Inclusion (LFI):** Highlights parameters commonly associated with file paths and file retrieval, including `cat`, `action`, `downloads`, and directory path values. - **Server-Side Request Forgery (SSRF) and Open Redirects:** Documents parameters related to outbound network operations or redirection, including `data`, `reference`, `callback`, `redirect`, and payment/callback endpoints.

The analytical pipeline relies on collecting research articles, pentest reports, and public bug bounty data, performing pattern modeling and formation, factoring in uncertain values and risk calculations, and generating finalized ranked lists.

### Takeaways The project demonstrates how analyzing high-frequency parameter patterns scientifically increases finding rates during vulnerability assessments. It raises ongoing research questions regarding the effectiveness of human-driven pattern extraction versus purely automated scanning. Furthermore, the broader security community and commercial tools have started integrating these datasets; Matt highlights ecosystem feedback such as PortSwigger community contributions, BApp Store extensions, and articles implementing Top-25 parameter wordlists for active testing tools. Future project goals include incorporating private bug bounty datasets if accessible and uniting automated data ingestion with manual validation.