DEV Community: Lokesh Kannan

OWASP Top 10: A09 & A10 — Logging, Alerting and Exceptional Conditions

Lokesh Kannan — Fri, 28 Aug 2026 12:56:45 +0000

A09 — Security Logging & Alerting Failures

Security logs help organizations detect, investigate, and respond to suspicious activities.

Security Logging & Alerting Failures occur when important security events are not properly recorded, monitored, or alerted.

Examples include:

Failed login attempts not being logged
Privilege changes not being recorded
Important security events missing from logs
No alerts for suspicious activity
Logs that are difficult to monitor or investigate

For example:

Multiple Failed Logins
|
Logging
|
Alerting
|
Security Investigation

Prevention: Log important security events, protect logs from unauthorized modification, monitor them regularly, and configure appropriate alerts.

Key point: If an attack cannot be detected, it becomes much harder to respond to it.

A10 — Mishandling of Exceptional Conditions

Applications constantly encounter unexpected situations such as invalid input, database failures, network errors, and resource limitations.

Mishandling of Exceptional Conditions occurs when these situations are handled insecurely.

For example, an application may normally deny an operation, but an unexpected error could cause it to fail open and accidentally allow the operation.

Common examples include:

Improper error handling
Failing open
Insecure default behavior
Unhandled exceptions
Exposing sensitive information through errors

A secure application should maintain its security controls even when something goes wrong.

Prevention: Handle errors safely, use secure defaults, validate unexpected conditions, and test failure scenarios.

Key point: Security should not disappear when the application encounters an error

OWASP Top 10: A07 & A08 — Authentication and Integrity Failures

Lokesh Kannan — Wed, 26 Aug 2026 13:33:15 +0000

A07 — Authentication Failures

Authentication is the process of verifying a user's identity.

Authentication failures occur when an application does not properly protect the process of verifying users or managing their sessions.

Common examples include:

Weak authentication mechanisms
Weak password policies
Poor session management
Missing protection against automated attacks
Insecure password recovery
Improper handling of authentication tokens

For example, an application that allows unlimited login attempts without appropriate protections may be vulnerable to automated credential attacks.

Prevention: Use strong authentication mechanisms, secure session management, multi-factor authentication where appropriate, and protections against automated attacks.

Key point: Authentication should securely verify identity and protect the user's session throughout the application.

A08 — Software or Data Integrity Failures

Software or Data Integrity Failures occur when an application trusts software, updates, code, or data without properly verifying its integrity or authenticity.

Examples include:

Untrusted software updates
Compromised dependencies
Insecure CI/CD processes
Improperly validated serialized data
Using software or plugins from untrusted sources

For example:

Software Update
↓
Integrity Verification
↓
Trusted → Install
Untrusted → Reject

If an application installs or processes modified software or data without proper verification, an attacker may be able to introduce malicious content.

Prevention: Verify software and data integrity, secure CI/CD pipelines, use trusted dependencies, and implement proper signing and verification mechanisms.

Key point: Never blindly trust software or data received from an external source.

OWASP Top 10: A05 & A06 — Injection and Insecure Design

Lokesh Kannan — Tue, 25 Aug 2026 12:19:19 +0000

A05 — Injection

Injection occurs when untrusted user input is interpreted as part of a command or query by an application.

Common examples include:

SQL Injection
NoSQL Injection
Command Injection
LDAP Injection
Cross-Site Scripting (XSS)

For example, if an application directly includes user input in a database query without proper validation or parameterization, an attacker may manipulate the query's behavior.

User Input
↓
Application
↓
Database / System
↓
Unexpected Behavior

Use parameterized queries, safe APIs, proper input validation, and context-aware output encoding.

Never trust user-controlled input.

A06 — Insecure Design

Insecure Design refers to security weaknesses introduced during the application's design or architecture rather than simply through coding mistakes.

For example, consider a password-reset system that allows unlimited reset attempts without considering rate limiting, abuse prevention, or account takeover scenarios.

The implementation might work exactly as designed—but the design itself is insecure.

Common examples include:

Missing security requirements
Poor authentication design
Lack of rate limiting
Weak authorization models
Missing abuse-case analysis
Inadequate threat modeling

Use threat modeling, secure design principles, security requirements, and architecture reviews early in the development lifecycle.

Security should be designed into an application, not added only after development.

OWASP Top 10: A03 & A04 — Software Supply Chain and Cryptographic Failures

Lokesh Kannan — Mon, 24 Aug 2026 10:50:45 +0000

A03 — Software Supply Chain Failures

Modern applications depend on many external components, such as open-source libraries, packages, frameworks, APIs, container images, and CI/CD tools.

Software Supply Chain Failures occur when these components or the processes used to build and deliver software are compromised or poorly secured.

Examples include:

Using compromised or malicious dependencies
Untrusted third-party packages
Outdated or vulnerable components
Compromised CI/CD pipelines
Insecure software updates

A vulnerability in a third-party dependency can potentially affect every application that depends on it.

Secure your application dependencies and the entire software development lifecycle—not just your own source code.

A04 — Cryptographic Failures

Cryptographic Failures occur when sensitive information is not properly protected using cryptography.

Examples include:

Storing passwords in plaintext
Using weak or outdated cryptographic algorithms
Poor encryption key management
Transmitting sensitive data without adequate protection
Using improperly configured encryption

Passwords should instead be securely hashed using an appropriate password-hashing algorithm.

Cryptography is only effective when the algorithms, keys, implementation, and configuration are handled correctly.

Burp Suite: Main Purposes in Web Security Testing

Lokesh Kannan — Mon, 24 Aug 2026 04:51:45 +0000

Burp Suite is a web application security testing platform developed by PortSwigger. It is widely used by penetration testers, security researchers, and developers to analyze and test web applications.

What is Burp Suite Used For?

The main purpose of Burp Suite is to intercept, inspect, modify, and test HTTP/HTTPS traffic between a browser and a web server.

Intercept Web Traffic

Burp Suite allows testers to capture requests and responses between the client and server.

Browser → Burp Suite → Server
Browser ← Burp Suite ← Server

Test Web Vulnerabilities

It can be used to investigate vulnerabilities such as:

Broken Access Control
SQL Injection
Cross-Site Scripting (XSS)
Authentication issues
Session management weaknesses
IDOR
Input validation problems

Modify and Replay Requests

With tools such as Repeater, testers can modify HTTP requests and send them again to observe how the application behaves.

Automate Security Testing

Intruder can automate customized requests for tasks such as parameter testing and controlled input testing.

Analyze Application Behavior

Burp Suite helps testers understand:

HTTP methods
Headers
Cookies
Parameters
Authentication tokens
API requests
Server responses
Why is Burp Suite Important?

Instead of treating a web application as a black box, Burp Suite allows security testers to see and interact with the application's HTTP communication.

It is an essential tool to learn for anyone interested in web application penetration testing and application security.

Burp Suite: What It Is, Why We Use It, and How It Works

Lokesh Kannan — Fri, 21 Aug 2026 16:31:56 +0000

When learning web application security, one of the most important tools to understand is Burp Suite.

Burp Suite is a web security testing platform developed by PortSwigger. It allows security professionals to inspect, modify, and test HTTP/HTTPS traffic between a browser and a web application.

Why Do We Use Burp Suite?

When we use a web application, the browser sends requests to the server and receives responses.

Burp Suite allows us to intercept and analyze this communication.

For example:

Browser → Burp Suite → Web Server
Browser ← Burp Suite ← Web Server

This makes it possible to understand how an application works and identify potential security issues.

Important Burp Suite Features

Proxy
Intercept and inspect HTTP/HTTPS requests and responses.

Repeater
Modify and resend requests manually to test how the application responds.

Intruder
Automate customized requests for authorized security testing, such as testing parameters and authentication controls.

Scanner
Helps identify common web vulnerabilities automatically. Availability depends on the Burp Suite edition.

Decoder
Encode and decode commonly used data formats such as URL encoding and Base64.

Comparer
Compare two requests or responses to identify differences.

Example

Suppose an application sends:

GET /profile?id=1001 HTTP/1.1
Host: example.com

Using Burp Suite, we can intercept the request and analyze how the application handles the id parameter.

This is useful when testing issues such as Broken Access Control, IDOR, and input validation in an authorized environment.

Burp Suite in Penetration Testing

A typical workflow can look like:

Browse Application
↓
Capture Requests
↓
Understand Parameters
↓
Modify Requests
↓
Test Security Controls
↓
Identify Vulnerabilities
↓
Report Findings

Burp Suite does not automatically make someone a penetration tester. The important skill is understanding HTTP, web application behavior, and security vulnerabilities, and then using Burp Suite to test them effectively.

Conclusion

Burp Suite is one of the most useful tools for web application security testing. It gives security professionals visibility into the communication between a client and server and provides tools for manually and automatically testing security controls.

For anyone starting web penetration testing, learning Burp Suite alongside HTTP fundamentals and the OWASP Top 10 is an excellent starting point.

OWASP Top 10: A01 & A02 — A Quick Introduction

Lokesh Kannan — Thu, 20 Aug 2026 17:03:09 +0000

A01 — Broken Access Control

Broken Access Control occurs when an application fails to properly enforce what users are allowed to access or perform.

For example, if a normal user can access an administrator-only page or view another user's data simply by changing an ID in the URL, the application may have an access control vulnerability.

Common examples include:

Accessing another user's data
Privilege escalation
Accessing admin functions as a normal user
Bypassing authorization checks

Key point: Authentication tells us who you are, while authorization determines what you can do.

A02 — Security Misconfiguration

Security Misconfiguration occurs when an application, server, cloud environment, or other component is configured insecurely.

Common examples include:

Default credentials
Debug mode enabled in production
Unnecessary services or ports exposed
Sensitive files publicly accessible
Missing security headers
Excessive permissions

Even a well-developed application can become vulnerable because of insecure configuration.

Key point: A secure application also needs a securely configured environment.

A01 vs A02

A simple way to remember the difference:

A01 → Permission problem
Who is allowed to do what?

A02 → Configuration problem
Is the system configured securely?

Understanding these two categories is a good starting point for anyone learning web application security and penetration testing.

Introduction to the OWASP Top 10: Building Secure Web Applications

Lokesh Kannan — Thu, 20 Aug 2026 16:56:23 +0000

Web applications are now a major part of our everyday lives. From online banking and shopping to social media, healthcare, and cloud services, we rely on web applications to store and process sensitive information.

But with this increased dependency comes an important question:

How secure are these applications?

This is where the OWASP Top 10 becomes important.

The OWASP Top 10 is a widely recognized awareness document that highlights some of the most critical security risks affecting web applications. It is maintained by the Open Worldwide Application Security Project (OWASP) and is commonly used by developers, penetration testers, security engineers, and organizations as a starting point for improving application security.

In this article, we will understand what the OWASP Top 10 is, why it matters, and get an introduction to each category in the latest OWASP Top 10:2025.

What is OWASP?

OWASP stands for Open Worldwide Application Security Project.

It is a nonprofit organization focused on improving software and application security. OWASP provides freely available security resources, documentation, tools, methodologies, and projects for the security and development communities.

One of its most well-known projects is the OWASP Top 10.

The project was first introduced in 2003 and has evolved over time as application security threats have changed.

What is the OWASP Top 10?

The OWASP Top 10 is a list of major security risk categories affecting web applications.

It is important to understand that the OWASP Top 10 is not a complete list of every web vulnerability.

Instead, it is an awareness and education document designed to help organizations and developers understand common and critical application security risks. OWASP itself describes it as a starting point rather than a complete security program.

For penetration testers, it provides a useful framework for thinking about what to test.

For developers, it helps identify common security mistakes during application development.

For security teams, it provides a common language for discussing application security.

OWASP Top 10:2025

The latest released version is OWASP Top 10:2025.

The current categories are:

Rank Category
A01 Broken Access Control
A02 Security Misconfiguration
A03 Software Supply Chain Failures
A04 Cryptographic Failures
A05 Injection
A06 Insecure Design
A07 Authentication Failures
A08 Software or Data Integrity Failures
A09 Security Logging & Alerting Failures
A10 Mishandling of Exceptional Conditions

These categories were updated based on application security data and community input.

Let's briefly understand each one.

A01:2025 — Broken Access Control

Access control determines what an authenticated user is allowed to do.

Broken Access Control occurs when an application fails to properly enforce these permissions.

For example, imagine a website where:

User A → /profile/1001
User B → /profile/1002

If User A changes the URL to:

/profile/1002

and can access User B's information, the application may have an access control vulnerability.

This type of issue can allow attackers to access unauthorized data, perform privileged actions, or access administrative functionality.

Broken Access Control remains the #1 category in the 2025 OWASP Top 10.

A02:2025 — Security Misconfiguration

Security misconfiguration happens when an application, server, framework, cloud service, or security component is incorrectly configured.

Examples include:

Default passwords
Unnecessary services
Debug mode enabled in production
Excessive permissions
Detailed error messages exposed to users
Missing security headers
Improper cloud configurations

A secure application can still become vulnerable if its underlying environment is poorly configured.

Interestingly, Security Misconfiguration moved from #5 in 2021 to #2 in 2025, reflecting its increased prevalence in the collected data.

A03:2025 — Software Supply Chain Failures

Modern applications rarely depend entirely on code written by their own developers.

Applications often use:

Open-source libraries
Frameworks
Package managers
Third-party APIs
CI/CD pipelines
Build systems
Container images

This creates a software supply chain.

If an attacker compromises a dependency, build system, package, or distribution mechanism, the application's security can be affected.

The 2025 OWASP Top 10 expanded this category from the previous Vulnerable and Outdated Components category to cover a much broader range of software supply-chain risks.

A04:2025 — Cryptographic Failures

Cryptography is used to protect sensitive information.

Cryptographic failures can occur when applications:

Store sensitive information without proper encryption
Use weak cryptographic algorithms
Use poor key management
Transmit sensitive information insecurely
Store passwords improperly

For example, passwords should never be stored as plaintext.

Instead, applications should use a suitable password hashing mechanism with appropriate configuration and secure credential-handling practices.

Cryptographic failures can lead to sensitive data exposure and, in some cases, further system compromise.

A05:2025 — Injection

Injection occurs when untrusted input is interpreted as part of a command or query.

One of the most well-known examples is SQL Injection.

Consider an application that constructs a database query directly from user input:

SELECT * FROM users WHERE username = '';

If user input is handled incorrectly, an attacker may manipulate the query.

Injection can affect different technologies, including:

SQL
NoSQL
Operating system commands
LDAP
Expression languages
Cross-Site Scripting (XSS)

Proper input handling, parameterized queries, output encoding, and secure APIs can significantly reduce injection risks.

A06:2025 — Insecure Design

Insecure Design focuses on security weaknesses introduced during the design stage of an application.

This is different from a simple implementation bug.

For example, imagine an application that allows unlimited password-reset attempts without considering rate limiting, abuse prevention, or account takeover scenarios.

The problem may exist in the application's design itself.

Security should therefore be considered before writing the code.

Useful practices include:

Threat modeling
Security requirements
Abuse-case analysis
Secure architecture
Security design reviews
A07:2025 — Authentication Failures

Authentication answers the question:

"Who are you?"

Authentication failures occur when an application incorrectly handles user identity verification.

Examples include:

Weak password policies
Poor session management
Credential stuffing exposure
Weak authentication mechanisms
Improper password recovery
Missing protections against automated login attacks

Strong authentication mechanisms, secure session management, multi-factor authentication, and proper credential handling are important defenses.

A08:2025 — Software or Data Integrity Failures

Applications rely on software, configuration, updates, serialized data, and other artifacts.

If the application trusts these components without properly verifying their integrity, attackers may be able to modify or replace them.

For example, an application that downloads an update but does not properly verify its authenticity or integrity could potentially execute malicious code.

This category focuses on maintaining trust in software and data across application boundaries.

A09:2025 — Security Logging & Alerting Failures

Logs are extremely important during security incidents.

If an attacker successfully compromises an application but the organization has poor logging and alerting, detecting the attack becomes much harder.

Important security events should be logged appropriately, such as:

Authentication failures
Privilege changes
Suspicious access
Administrative actions
Security-related errors

However, collecting logs alone is not enough.

Security teams also need appropriate alerting and monitoring so that important events can trigger an investigation.

OWASP specifically emphasizes alerting in the 2025 category name because logs without effective alerting may have limited value during an active incident.

A10:2025 — Mishandling of Exceptional Conditions

This is a new category in OWASP Top 10:2025.

Applications regularly encounter unexpected situations:

Invalid input
Network failures
Missing files
Database failures
Resource exhaustion
Unexpected application states

If these conditions are handled incorrectly, security controls may be bypassed.

For example, an application might normally deny an operation, but due to an unexpected error it accidentally fails open and allows the operation.

Proper error handling, secure defaults, validation, and testing of abnormal conditions are important defenses.

What Changed from OWASP Top 10:2021?

If you have previously studied the 2021 version, the 2025 version has several important changes.

The biggest changes include:

Software Supply Chain Failures expands the scope of the previous Vulnerable and Outdated Components category.

Mishandling of Exceptional Conditions is a completely new category.

SSRF (Server-Side Request Forgery) has been incorporated into Broken Access Control rather than remaining as a separate category.

Security Misconfiguration also moved significantly upward, from #5 in 2021 to #2 in 2025.

This shows an important point: application security changes over time. The risks that developers and security professionals need to focus on can evolve as software architectures and attack techniques change.

Why Should Cybersecurity Students Learn OWASP Top 10?

If you're learning cybersecurity, especially web application penetration testing, OWASP Top 10 is an excellent starting point.

It helps you develop a security mindset.

Instead of randomly testing an application, you can start asking structured questions:

Can I access another user's data?

Can I bypass authorization?

Can I manipulate application input?

Are sensitive credentials protected?

Is authentication implemented securely?

Are security-sensitive actions logged?

What happens when the application encounters an unexpected error?

Are third-party dependencies trustworthy?

These questions form the foundation of a more systematic web application security assessment.

OWASP Top 10 and Penetration Testing

The OWASP Top 10 should not be treated as a simple checklist where you test ten vulnerabilities and stop.

A real penetration test involves understanding the application's:

Attack surface
Architecture
Authentication mechanisms
Authorization model
Business logic
APIs
Data flows
Dependencies
Infrastructure
Security controls

The OWASP Top 10 provides a useful foundation, but experienced testers need to think beyond the list.

OWASP itself emphasizes that the Top 10 is intentionally limited to ten major risks and should be considered a starting point rather than a complete application security program.

Final Thoughts

The OWASP Top 10 is one of the best starting points for anyone entering web application security.

For beginners, it provides a structured way to understand common security weaknesses.

For developers, it highlights security problems that should be considered during the software development lifecycle.

For penetration testers, it provides a useful foundation for organizing testing and understanding common attack paths.

But learning the names of the ten categories is not enough.

The real goal is to understand why these vulnerabilities happen, how they can be identified, how they can be exploited in authorized environments, and most importantly, how they can be prevented.

If you're beginning your journey into application security or penetration testing, learning the OWASP Top 10 is a great first step.

Next step: Pick one category—such as Broken Access Control or Injection—and build a small vulnerable application in a legal lab environment. Then try to identify, exploit, and fix the vulnerability yourself.

That is where the theory starts becoming practical cybersecurity knowledge.

References
OWASP Top 10:2025 — Official OWASP Project
OWASP Top 10:2025 Introduction
OWASP Top Ten Project