DEV Community: Lokesh Kannan

Burp Suite: What It Is, Why We Use It, and How It Works

Lokesh Kannan — Fri, 21 Aug 2026 16:31:56 +0000

When learning web application security, one of the most important tools to understand is Burp Suite.

Burp Suite is a web security testing platform developed by PortSwigger. It allows security professionals to inspect, modify, and test HTTP/HTTPS traffic between a browser and a web application.

Why Do We Use Burp Suite?

When we use a web application, the browser sends requests to the server and receives responses.

Burp Suite allows us to intercept and analyze this communication.

For example:

Browser → Burp Suite → Web Server
Browser ← Burp Suite ← Web Server

This makes it possible to understand how an application works and identify potential security issues.

Important Burp Suite Features

Proxy
Intercept and inspect HTTP/HTTPS requests and responses.

Repeater
Modify and resend requests manually to test how the application responds.

Intruder
Automate customized requests for authorized security testing, such as testing parameters and authentication controls.

Scanner
Helps identify common web vulnerabilities automatically. Availability depends on the Burp Suite edition.

Decoder
Encode and decode commonly used data formats such as URL encoding and Base64.

Comparer
Compare two requests or responses to identify differences.

Example

Suppose an application sends:

GET /profile?id=1001 HTTP/1.1
Host: example.com

Using Burp Suite, we can intercept the request and analyze how the application handles the id parameter.

This is useful when testing issues such as Broken Access Control, IDOR, and input validation in an authorized environment.

Burp Suite in Penetration Testing

A typical workflow can look like:

Browse Application
↓
Capture Requests
↓
Understand Parameters
↓
Modify Requests
↓
Test Security Controls
↓
Identify Vulnerabilities
↓
Report Findings

Burp Suite does not automatically make someone a penetration tester. The important skill is understanding HTTP, web application behavior, and security vulnerabilities, and then using Burp Suite to test them effectively.

Conclusion

Burp Suite is one of the most useful tools for web application security testing. It gives security professionals visibility into the communication between a client and server and provides tools for manually and automatically testing security controls.

For anyone starting web penetration testing, learning Burp Suite alongside HTTP fundamentals and the OWASP Top 10 is an excellent starting point.

OWASP Top 10: A01 & A02 — A Quick Introduction

Lokesh Kannan — Thu, 20 Aug 2026 17:03:09 +0000

A01 — Broken Access Control

Broken Access Control occurs when an application fails to properly enforce what users are allowed to access or perform.

For example, if a normal user can access an administrator-only page or view another user's data simply by changing an ID in the URL, the application may have an access control vulnerability.

Common examples include:

Accessing another user's data
Privilege escalation
Accessing admin functions as a normal user
Bypassing authorization checks

Key point: Authentication tells us who you are, while authorization determines what you can do.

A02 — Security Misconfiguration

Security Misconfiguration occurs when an application, server, cloud environment, or other component is configured insecurely.

Common examples include:

Default credentials
Debug mode enabled in production
Unnecessary services or ports exposed
Sensitive files publicly accessible
Missing security headers
Excessive permissions

Even a well-developed application can become vulnerable because of insecure configuration.

Key point: A secure application also needs a securely configured environment.

A01 vs A02

A simple way to remember the difference:

A01 → Permission problem
Who is allowed to do what?

A02 → Configuration problem
Is the system configured securely?

Understanding these two categories is a good starting point for anyone learning web application security and penetration testing.

Introduction to the OWASP Top 10: Building Secure Web Applications

Lokesh Kannan — Thu, 20 Aug 2026 16:56:23 +0000

Web applications are now a major part of our everyday lives. From online banking and shopping to social media, healthcare, and cloud services, we rely on web applications to store and process sensitive information.

But with this increased dependency comes an important question:

How secure are these applications?

This is where the OWASP Top 10 becomes important.

The OWASP Top 10 is a widely recognized awareness document that highlights some of the most critical security risks affecting web applications. It is maintained by the Open Worldwide Application Security Project (OWASP) and is commonly used by developers, penetration testers, security engineers, and organizations as a starting point for improving application security.

In this article, we will understand what the OWASP Top 10 is, why it matters, and get an introduction to each category in the latest OWASP Top 10:2025.

What is OWASP?

OWASP stands for Open Worldwide Application Security Project.

It is a nonprofit organization focused on improving software and application security. OWASP provides freely available security resources, documentation, tools, methodologies, and projects for the security and development communities.

One of its most well-known projects is the OWASP Top 10.

The project was first introduced in 2003 and has evolved over time as application security threats have changed.

What is the OWASP Top 10?

The OWASP Top 10 is a list of major security risk categories affecting web applications.

It is important to understand that the OWASP Top 10 is not a complete list of every web vulnerability.

Instead, it is an awareness and education document designed to help organizations and developers understand common and critical application security risks. OWASP itself describes it as a starting point rather than a complete security program.

For penetration testers, it provides a useful framework for thinking about what to test.

For developers, it helps identify common security mistakes during application development.

For security teams, it provides a common language for discussing application security.

OWASP Top 10:2025

The latest released version is OWASP Top 10:2025.

The current categories are:

Rank Category
A01 Broken Access Control
A02 Security Misconfiguration
A03 Software Supply Chain Failures
A04 Cryptographic Failures
A05 Injection
A06 Insecure Design
A07 Authentication Failures
A08 Software or Data Integrity Failures
A09 Security Logging & Alerting Failures
A10 Mishandling of Exceptional Conditions

These categories were updated based on application security data and community input.

Let's briefly understand each one.

A01:2025 — Broken Access Control

Access control determines what an authenticated user is allowed to do.

Broken Access Control occurs when an application fails to properly enforce these permissions.

For example, imagine a website where:

User A → /profile/1001
User B → /profile/1002

If User A changes the URL to:

/profile/1002

and can access User B's information, the application may have an access control vulnerability.

This type of issue can allow attackers to access unauthorized data, perform privileged actions, or access administrative functionality.

Broken Access Control remains the #1 category in the 2025 OWASP Top 10.

A02:2025 — Security Misconfiguration

Security misconfiguration happens when an application, server, framework, cloud service, or security component is incorrectly configured.

Examples include:

Default passwords
Unnecessary services
Debug mode enabled in production
Excessive permissions
Detailed error messages exposed to users
Missing security headers
Improper cloud configurations

A secure application can still become vulnerable if its underlying environment is poorly configured.

Interestingly, Security Misconfiguration moved from #5 in 2021 to #2 in 2025, reflecting its increased prevalence in the collected data.

A03:2025 — Software Supply Chain Failures

Modern applications rarely depend entirely on code written by their own developers.

Applications often use:

Open-source libraries
Frameworks
Package managers
Third-party APIs
CI/CD pipelines
Build systems
Container images

This creates a software supply chain.

If an attacker compromises a dependency, build system, package, or distribution mechanism, the application's security can be affected.

The 2025 OWASP Top 10 expanded this category from the previous Vulnerable and Outdated Components category to cover a much broader range of software supply-chain risks.

A04:2025 — Cryptographic Failures

Cryptography is used to protect sensitive information.

Cryptographic failures can occur when applications:

Store sensitive information without proper encryption
Use weak cryptographic algorithms
Use poor key management
Transmit sensitive information insecurely
Store passwords improperly

For example, passwords should never be stored as plaintext.

Instead, applications should use a suitable password hashing mechanism with appropriate configuration and secure credential-handling practices.

Cryptographic failures can lead to sensitive data exposure and, in some cases, further system compromise.

A05:2025 — Injection

Injection occurs when untrusted input is interpreted as part of a command or query.

One of the most well-known examples is SQL Injection.

Consider an application that constructs a database query directly from user input:

SELECT * FROM users WHERE username = '';

If user input is handled incorrectly, an attacker may manipulate the query.

Injection can affect different technologies, including:

SQL
NoSQL
Operating system commands
LDAP
Expression languages
Cross-Site Scripting (XSS)

Proper input handling, parameterized queries, output encoding, and secure APIs can significantly reduce injection risks.

A06:2025 — Insecure Design

Insecure Design focuses on security weaknesses introduced during the design stage of an application.

This is different from a simple implementation bug.

For example, imagine an application that allows unlimited password-reset attempts without considering rate limiting, abuse prevention, or account takeover scenarios.

The problem may exist in the application's design itself.

Security should therefore be considered before writing the code.

Useful practices include:

Threat modeling
Security requirements
Abuse-case analysis
Secure architecture
Security design reviews
A07:2025 — Authentication Failures

Authentication answers the question:

"Who are you?"

Authentication failures occur when an application incorrectly handles user identity verification.

Examples include:

Weak password policies
Poor session management
Credential stuffing exposure
Weak authentication mechanisms
Improper password recovery
Missing protections against automated login attacks

Strong authentication mechanisms, secure session management, multi-factor authentication, and proper credential handling are important defenses.

A08:2025 — Software or Data Integrity Failures

Applications rely on software, configuration, updates, serialized data, and other artifacts.

If the application trusts these components without properly verifying their integrity, attackers may be able to modify or replace them.

For example, an application that downloads an update but does not properly verify its authenticity or integrity could potentially execute malicious code.

This category focuses on maintaining trust in software and data across application boundaries.

A09:2025 — Security Logging & Alerting Failures

Logs are extremely important during security incidents.

If an attacker successfully compromises an application but the organization has poor logging and alerting, detecting the attack becomes much harder.

Important security events should be logged appropriately, such as:

Authentication failures
Privilege changes
Suspicious access
Administrative actions
Security-related errors

However, collecting logs alone is not enough.

Security teams also need appropriate alerting and monitoring so that important events can trigger an investigation.

OWASP specifically emphasizes alerting in the 2025 category name because logs without effective alerting may have limited value during an active incident.

A10:2025 — Mishandling of Exceptional Conditions

This is a new category in OWASP Top 10:2025.

Applications regularly encounter unexpected situations:

Invalid input
Network failures
Missing files
Database failures
Resource exhaustion
Unexpected application states

If these conditions are handled incorrectly, security controls may be bypassed.

For example, an application might normally deny an operation, but due to an unexpected error it accidentally fails open and allows the operation.

Proper error handling, secure defaults, validation, and testing of abnormal conditions are important defenses.

What Changed from OWASP Top 10:2021?

If you have previously studied the 2021 version, the 2025 version has several important changes.

The biggest changes include:

Software Supply Chain Failures expands the scope of the previous Vulnerable and Outdated Components category.

Mishandling of Exceptional Conditions is a completely new category.

SSRF (Server-Side Request Forgery) has been incorporated into Broken Access Control rather than remaining as a separate category.

Security Misconfiguration also moved significantly upward, from #5 in 2021 to #2 in 2025.

This shows an important point: application security changes over time. The risks that developers and security professionals need to focus on can evolve as software architectures and attack techniques change.

Why Should Cybersecurity Students Learn OWASP Top 10?

If you're learning cybersecurity, especially web application penetration testing, OWASP Top 10 is an excellent starting point.

It helps you develop a security mindset.

Instead of randomly testing an application, you can start asking structured questions:

Can I access another user's data?

Can I bypass authorization?

Can I manipulate application input?

Are sensitive credentials protected?

Is authentication implemented securely?

Are security-sensitive actions logged?

What happens when the application encounters an unexpected error?

Are third-party dependencies trustworthy?

These questions form the foundation of a more systematic web application security assessment.

OWASP Top 10 and Penetration Testing

The OWASP Top 10 should not be treated as a simple checklist where you test ten vulnerabilities and stop.

A real penetration test involves understanding the application's:

Attack surface
Architecture
Authentication mechanisms
Authorization model
Business logic
APIs
Data flows
Dependencies
Infrastructure
Security controls

The OWASP Top 10 provides a useful foundation, but experienced testers need to think beyond the list.

OWASP itself emphasizes that the Top 10 is intentionally limited to ten major risks and should be considered a starting point rather than a complete application security program.

Final Thoughts

The OWASP Top 10 is one of the best starting points for anyone entering web application security.

For beginners, it provides a structured way to understand common security weaknesses.

For developers, it highlights security problems that should be considered during the software development lifecycle.

For penetration testers, it provides a useful foundation for organizing testing and understanding common attack paths.

But learning the names of the ten categories is not enough.

The real goal is to understand why these vulnerabilities happen, how they can be identified, how they can be exploited in authorized environments, and most importantly, how they can be prevented.

If you're beginning your journey into application security or penetration testing, learning the OWASP Top 10 is a great first step.

Next step: Pick one category—such as Broken Access Control or Injection—and build a small vulnerable application in a legal lab environment. Then try to identify, exploit, and fix the vulnerability yourself.

That is where the theory starts becoming practical cybersecurity knowledge.

References
OWASP Top 10:2025 — Official OWASP Project
OWASP Top 10:2025 Introduction
OWASP Top Ten Project