1. What is OWASP Top 10?

(Very Simple Explanation)

First: What is OWASP?

OWASP = Open Worldwide Application Security Project

It is a global, non-profit organization that studies how web applications are attacked.

What is the OWASP Top 10?

The OWASP Top 10 is a list of the 10 most dangerous and common security problems
found in web applications.

⚠️Important:

 It is not every possible vulnerability

 It focuses on:
o Most common
o Most damaging
o Most real-world risks

Think of it like:

The “Top 10 diseases” doctors warn about — not all diseases, but the most deadly ones.

Why OWASP Top 10 Matters

 Used by banks, fintechs, governments

 Referenced in audits, compliance, and exams
 Helps developers know what to avoid first

2021 Update (Why It Changed)

The 2021 OWASP Top 10:

 Added focus on design mistakes

 Added focus on logging and monitoring
This shows that bad planning can be as dangerous as bad coding.

2. A01: Broken Access Control (BAC)

What Access Control Means

Access control answers:

Who is allowed to do what?

Broken Access Control means:

 The system fails to enforce rules

 Users can see or do things they should not

Simple Real-Life Example

In a hospital:

 A nurse should see patient records

 A cleaner should not

If the cleaner can open patient files → Broken Access Control

Technical Example (Banking App – IDOR)

URL:

[Link]

If a user changes it to:

account_id=98765

and sees another customer’s balance, then:

✔ The user is authenticated

❌ The user is not authorized

👉 This is Broken Access Control

Why This Is Dangerous

 Data theft
 Account takeover
 Regulatory fines
How to Fix It (Mitigation)

1. Deny by Default
o No access unless explicitly allowed
2. Check every request
o Don’t trust URLs or user input
3. Least Privilege (PoLP)
o Give users only what they need

3. A02: Cryptographic Failures

What This Really Means

Cryptographic failure = Sensitive data is not properly protected

This can happen:

 While data is being sent (in transit)

 While data is stored (at rest)

Simple Real-Life Example

Sending a password on paper instead of in a sealed envelope.

Anyone who sees it can read it.

Technical Example (HTTP vs HTTPS)

 HTTP = open, readable

 HTTPS = encrypted

If a registration form sends passwords over HTTP:

 Hackers on Wi-Fi can steal passwords

 Even if the database is encrypted

👉 Data was exposed during transmission

Common Mistakes

 No encryption
 Weak encryption
 Storing passwords as plain text

How to Fix It

 Use HTTPS / TLS 1.2+

 Encrypt sensitive data (e.g. AES-256)
 Hash passwords (bcrypt / Argon2)
 Protect encryption keys properly

4. A03: Injection (SQL, NoSQL, OS Command)

What Injection Means

Injection happens when:

User input is treated as a command instead of data

Simple Real-Life Example

A receptionist writes down:

“Do not open this door”

But someone adds:

“— except for John”

And the guard obeys it without checking.

SQL Injection Example (Login Bypass)

User enters this as password:

' OR 1=1 --

This tricks the database into thinking:

“Always true”

Result:

 Login succeeds without a real password

Why This Is Dangerous

 Database access
 Data deletion
 Full system compromise

How to Fix It

✔ Parameterized Queries (Prepared Statements)

✔ Input validation (only allow expected values)
✔ Output encoding

This ensures:

 User input = data

 Never executed as code

5. A04: Insecure Design (New & Important)

What This Means (Very Important)

Insecure Design is not a coding mistake

It is a planning mistake

The system is insecure by design

Simple Real-Life Example

Building a bank:

 No security cameras
 No guards
 No lock on the vault

Even if the door is strong — the design is weak.

Technical Example (No Rate Limiting)

A login system:

 Allows unlimited login attempts

 No delays or lockouts

Attackers can:

 Try millions of passwords quickly

👉 Even perfect code cannot fix a bad design

How to Fix It

 Use Secure SDLC

 Do Threat Modeling early
 Ask:
o “What can go wrong?”
o “How could this be abused?”

6. A05: Security Misconfiguration

What This Means

Security misconfiguration happens when:

 Default settings are left unchanged

 Unnecessary features are enabled
 Errors show too much information
Simple Real-Life Example

Moving into a house:

 Leaving doors unlocked

 Leaving spare keys outside
 Posting alarm codes on the wall

Technical Examples

 Default admin account still active

 Error pages show:
o Server version
o File paths
 Unused ports open

Attackers love this information.

How to Fix It

 Harden systems
 Remove default accounts
 Disable unused services
 Automate patching and configuration

7. One-Table Summary (Easy to Remember)

OWASP Risk Simple Meaning Main Fix

Broken Access Control Users do what they shouldn’t Deny by default
Cryptographic Failures Data not protected Encrypt properly
Injection Input becomes command Prepared statements
Insecure Design Bad planning Threat modeling
Security Misconfiguration Unsafe settings Hardening & patching
🔐 A01: Broken Access Control (IDOR)
📌 Easy Scenario Explanation

Imagine a student portal.

 You log in and your profile URL looks like this:

 /user_profile/123

 You become curious and change 123 → 124 in the browser.

 Suddenly, you can see another student’s private information.

👉 You didn’t hack anything technically — you just changed a number.

❓ What is the OWASP vulnerability?

A01: Broken Access Control

More specifically:
➡ IDOR (Insecure Direct Object Reference)

This happens when:

 The system trusts the ID in the URL

 But does not check if you are allowed to see that data

❌ What defense was missing?

“Deny by Default” + Server-Side Authorization Check

The server should have checked:

“Is User X allowed to view User Y’s data?”

But it did not.

✅ Correct Answer

 Vulnerability: A01 – Broken Access Control (IDOR)

  Missing Defense:
o Server-side authorization check
o Deny-by-default principle (only allow access if explicitly permitted)

📝 Example Exam Answer

This scenario is an example of A01: Broken Access Control, specifically IDOR. The application
failed to enforce server-side authorization checks to confirm whether the logged-in user was
permitted to access another user’s data. The deny-by-default principle was missing.

💉 A03: Injection (SQL Injection & XSS)

📌 Easy Scenario Explanation

A website has a search box for products.

Attempt 1 (SQL Injection):

The attacker types:

'; DROP TABLE products; --

But nothing happens ❌

Because the system escaped single quotes.

Attempt 2 (XSS):

The attacker types:

<script>alert('Hacked')</script>

Now a pop-up appears on the page ✅

👉 Two different attacks were tested.

❓ Which two vulnerabilities are involved?

1. SQL Injection (SQLi)

 2. Cross-Site Scripting (XSS)

Both fall under:

➡ A03: Injection

❓ What is the difference in defense mechanisms?

Vulnerability What it Attacks Proper Defense

SQL Injection Database Prepared Statements / Parameterized Queries
XSS Browser (users) Output Encoding / Escaping HTML

❌ What went wrong?

 SQL Injection was properly handled

 XSS was not prevented

✅ Correct Answer

 Vulnerabilities Tested:
o SQL Injection
o Cross-Site Scripting (XSS)
 Defense Difference:
o SQLi → Prepared Statements
o XSS → Output Encoding

📝 Example Exam Answer

The scenario tests two A03 Injection vulnerabilities: SQL Injection and Cross-Site Scripting.
SQL Injection is mitigated using prepared statements, while XSS requires proper output
encoding to prevent malicious scripts from executing in the user’s browser.

💳 A04: Insecure Design

📌 Easy Scenario Explanation
An online shop calculates the total price in the browser.

 Original price shown: TZS 100

 Before payment, the attacker changes it to TZS 1
 The server accepts the price without checking

👉 The server trusted the browser, which is dangerous.

❓ Which OWASP risk is this?

➡ A04: Insecure Design

This is not a coding mistake — it’s a bad system design decision.

❌ What principle was violated?

Never Trust the Client

Critical logic (like pricing):

 ❌ Should NOT be done in the browser

 ✅ MUST be done on the server

✅ Correct Answer

 OWASP Risk: A04 – Insecure Design

 Violated Principle:
o Never Trust the Client
o Critical business logic must be server-side

📝 Example Exam Answer

This scenario falls under A04: Insecure Design. The application violated the principle of never
trusting the client by relying on client-side price calculations instead of validating them on the
server.
📦 A06: Vulnerable and Outdated Components
📌 Easy Scenario Explanation

Your application uses a free open-source library.

 A scan shows it has a known vulnerability

 The problem was fixed 3 years ago
 Your system still uses the old version

👉 Hackers already know how to exploit it.

❓ Which OWASP risk is this?

➡ A06: Vulnerable and Outdated Components

❓ What should be done immediately?

1. Upgrade or patch the library

2. Use a Software Composition Analysis (SCA) tool
o To track vulnerable dependencies

✅ Correct Answer

 OWASP Risk: A06 – Vulnerable and Outdated Components

 Primary Mitigation:
o Immediate patching/upgrading
o Use SCA tools

📝 Example Exam Answer

This scenario represents A06: Vulnerable and Outdated Components. The primary mitigation is
to immediately upgrade or patch the vulnerable library and continuously monitor dependencies
using a Software Composition Analysis tool.
📊 A09: Security Logging and Monitoring Failures
📌 Easy Scenario Explanation

Someone logs in without authorization.

But the system:

 Logs only successful logins

 Does NOT log:
o Failed attempts
o IP addresses
o Authentication methods

👉 The security team cannot investigate what happened.

❓ Which OWASP vulnerability is this?

➡ A09: Security Logging and Monitoring Failures

❌ What is missing?

Proper security logging:

 Failed logins
 Source IP
 Timestamps
 Authentication method
 Security-related events

✅ Correct Answer

 OWASP Risk: A09 – Security Logging and Monitoring Failures

 Required Improvement:
o Log both successful and failed events
 o Include full security context

📝 Example Exam Answer

This scenario illustrates A09: Security Logging and Monitoring Failures. The application must
be improved to log failed authentication attempts, source IP addresses, timestamps, and other
relevant security details to support incident detection and response.