DEV Community

sergio gómez
sergio gómez

Posted on

Understanding the OWASP Top 10: Practical Examples for Secure Development

#tutorial #python #beginners #security

The OWASP Top 10 is the industry’s most widely referenced list of web‑application risks. Updated every few years, it highlights the threats that most often lead to data loss, service disruption, or compromise of user accounts. Knowing the categories is only the first step; developers need to see how each risk manifests in code and what concrete actions can stop it.

1. Quick Overview

Rank Vulnerability Why It Matters
A01 Broken Access Control Lets attackers act as another user or gain privileged functions.
A02 Cryptographic Failures Exposes sensitive data through weak or misused encryption.
A03 Injection Allows hostile data to be executed by the interpreter.
A04 Insecure Design Missing security controls at the architectural level.
A05 Security Misconfiguration Default settings, unnecessary features, or outdated components are exposed.
A06 Vulnerable and Outdated Components Known flaws in libraries or frameworks.
A07 Identification and Authentication Failures Weak verification of user identity.
A08 Software and Data Integrity Failures Malicious code or data enters the pipeline.
A09 Security Logging and Monitoring Failures Detection and response are hindered.
A10 Server‑Side Request Forgery (SSRF) Forces the server to make unintended HTTP requests.

2. Real‑World Examples

A01 – Broken Access Control 

@GetMapping("/profile")
public User getProfile(@RequestParam String userId) {
    return userRepository.findById(userId);
}
Enter fullscreen mode Exit fullscreen mode

Without verifying that the caller owns userId, any authenticated user can read another’s profile.

A02 – Cryptographic Failures 

import hashlib
def store_password(pw):
    return hashlib.sha1(pw.encode()).hexdigest()
Enter fullscreen mode Exit fullscreen mode

SHA‑1 is fast and vulnerable; without a salt and a slow algorithm (e.g., bcrypt), attackers can brute‑force passwords quickly.

A03 – Injection 

$uid = $_GET['id'];
$sql = "SELECT * FROM orders WHERE user_id = $uid";
$result = $db->query($sql);
Enter fullscreen mode Exit fullscreen mode

If id is 0 OR 1=1, the query returns every order. The same pattern applies to NoSQL, LDAP, and command‑line injections.

A04 – Insecure Design

A front‑end form limits transfer amounts to the account balance, but the back‑end accepts the posted value without validation. An attacker can bypass the UI and submit a larger amount, causing overdrafts.

A05 – Security Misconfiguration 

Options +Indexes
Enter fullscreen mode Exit fullscreen mode

Enabling directory listing lets attackers enumerate files, discover configuration files, and locate backup copies of source code.

A06 – Vulnerable and Outdated Components 

<script src="https://cdn.example.com/jquery-1.9.1.min.js"></script>
Enter fullscreen mode Exit fullscreen mode

Even clean application code can be compromised by a library with a known XSS flaw.

A07 – Identification and Authentication Failures 

if (VerifyHash(inputPassword, storedHash)) {
    // login success
}
Enter fullscreen mode Exit fullscreen mode

Without rate limiting or MFA, credential‑stuffing attacks become trivial.

A08 – Software and Data Integrity Failures 

curl -O http://example.com/plugin.jar
java -jar plugin.jar
Enter fullscreen mode Exit fullscreen mode

Downloading a plugin without verifying its signature allows an attacker to replace it with malicious code that runs with the application’s privileges.

A09 – Security Logging and Monitoring Failures 

chmod 666 /var/log/auth.log
Enter fullscreen mode Exit fullscreen mode

World‑readable logs can be tampered with, making post‑incident analysis impossible.

A10 – Server‑Side Request Forgery (SSRF) 

func fetchImage(url string) ([]byte, error) {
    resp, err := http.Get(url)
    // ...
}
Enter fullscreen mode Exit fullscreen mode

If an attacker supplies http://169.254.169.254/latest/meta-data/, the server can retrieve internal metadata and expose cloud credentials.

3. Mitigation Strategies

Vulnerability Core Mitigation Code‑Level Tips
Broken Access Control Centralized authorization checks Use RBAC libraries; never trust client‑supplied IDs
Cryptographic Failures Modern, vetted algorithms; salts; KDFs In Java, use PBKDF2 with a per‑user salt; in Node.js, crypto.pbkdf2
Injection Parameterized queries or prepared statements In Python’s psycopg2, cursor.execute("SELECT … WHERE id = %s", (uid,))
Insecure Design Threat modeling early; document security use cases Review design documents for missing controls
Security Misconfiguration Harden defaults; automate configuration testing Use OpenSCAP or Docker Bench to validate settings
Vulnerable Components SBOM; monitor CVE feeds; patch promptly Dependabot or Snyk in CI to flag outdated dependencies
Authentication Failures Strong password policies; MFA; lockout Store passwords with bcrypt (cost ≥12); limit login attempts per IP
Integrity Failures Sign all third‑party artifacts; verify signatures Use cosign for container images; gpg for scripts
Logging Failures Centralized, tamper‑resistant logs; proper retention Forward logs to a SIEM over TLS; set file permissions to 600
SSRF Whitelist outbound destinations; validate URLs Reject URLs that resolve to private IP ranges; use a policy‑enforcing proxy

Combining static analysis, dynamic testing, and regular penetration exercises creates a defense‑in‑depth posture that reduces the likelihood of a breach.

4. Integrating OWASP Practices into the Development Workflow

  1. Shift‑Left Security – Add SAST tools to the CI pipeline to flag injection patterns, insecure cryptography, and vulnerable libraries before merges.
  2. Automated Dependency Scanning – Run a dependency‑check step on every pull request; fail the build if a known CVE is detected.
  3. Secure Code Review Checklist – Extend peer reviews with an OWASP checklist: verify authorization, input sanitization, and cryptographic usage.
  4. Continuous Monitoring – Deploy RASP or a WAF to detect and block attacks targeting Top 10 categories; alert on anomalous authentication or outbound requests.
  5. Training and Awareness – Hold regular workshops that walk developers through the Top 10 examples and mitigation patterns.

By embedding these practices into the development lifecycle, teams can catch and remediate the most common web‑application vulnerabilities before they reach production.

Divulgación (normas IA de DEV): este artículo fue elaborado con asistencia de IA — Jarvis, un asistente autónomo corriendo en una Raspberry Pi —, verificado contra las fuentes citadas y supervisado por Sergio antes de publicar.

Top comments (0)