Hello! In our previous lesson, we explored the "why" and "how" of vulnerability assessments, focusing on the process that identifies security weaknesses in the software development lifecycle. We saw that VAs produce a prioritized list of issues for developers to fix.
Today, we'll dive into the "what" — a foundational tool that helps create that priority list. This lesson will introduce you to the OWASP Top 10, a globally recognized document that lists the most critical security risks to web applications. Understanding this list is essential, as it provides a roadmap for us to navigate the most common vulnerabilities you'll encounter, including the Cross-Site Scripting (XSS) issue that is central to your goal.
By the end of this lesson, you will be able to identify the OWASP Top 10 and understand its role as a standard for prioritizing web application security risks.
What is OWASP and the Top 10?
The Open Worldwide Application Security Project (OWASP) is a non-profit foundation dedicated to improving software security. It operates through open, community-led projects, and one of its most famous contributions is the OWASP Top 10.
The Top 10 is not an exhaustive list of every possible vulnerability. Instead, it's a powerful awareness document that represents a broad consensus on the ten most critical risk categories facing web applications today. It's created for developers and security professionals to provide a common language and a starting point for securing applications.
To get a clear understanding of what the OWASP Top 10 is and how the list is compiled, let's start with a short video.
OWASP Top 10 2021 - The List and How You Should Use It
This video from Cyber Citadel provides an excellent overview of the OWASP Top 10, explaining its purpose and the data-driven process behind its creation.
Please watch the video from the beginning up to the timestamp 02:04. Focus on what OWASP is, the purpose of the Top 10 list, and how it is compiled from both data and community surveys.
As the video explained, the list is updated every few years using real-world data from security testing and contributions from the security community. This ensures it stays relevant to the threats developers face in the wild.
It's also useful to know that while the Top 10 is a vital awareness tool, OWASP provides more rigorous standards for teams looking to implement a comprehensive security program. One such standard is the Application Security Verification Standard (ASVS), which is a much more detailed and testable framework. For our purposes, the Top 10 is the perfect starting point for understanding the landscape of common vulnerabilities.
The OWASP Top 10 2021 List
Now, let's get to the list itself. The most recent version as of our course is the OWASP Top 10 2021. The following infographic provides a great visual summary of the ten categories.
To understand what each of these categories means, we'll return to the video you started, which provides a concise explanation of each item.
OWASP Top 10 2021 - The List and How You Should Use It
Let's continue with the Cyber Citadel video to walk through each of the ten categories.
Please watch the segment from 02:04 to 07:29. The speaker will explain each of the Top 10 risks, from Broken Access Control to Server-Side Request Forgery.
To reinforce what you just watched, here are the ten categories from the 2021 list:
- A01:2021 - Broken Access Control: Flaws that allow users to act outside of their intended permissions. This is the most common and critical risk category.
- A02:2021 - Cryptographic Failures: Failures related to cryptography (or lack thereof), which often lead to the exposure of sensitive data.
- A03:2021 - Injection: Flaws, such as SQL injection, that allow an attacker to inject malicious data into an application, which is then executed or interpreted. Cross-Site Scripting (XSS) used to be a separate category but is now part of this broader Injection category.
- A04:2021 - Insecure Design: A new category focusing on risks related to design and architectural flaws, emphasizing the need for threat modeling and secure design patterns.
- A05:2021 - Security Misconfiguration: Errors in security configuration, such as using default credentials, having open cloud storage, or exposing error messages with sensitive information.
- A06:2021 - Vulnerable and Outdated Components: Using libraries, frameworks, and other software components with known vulnerabilities.
- A07:2021 - Identification and Authentication Failures: Weaknesses in user identity management, authentication, and session management.
- A08:2021 - Software and Data Integrity Failures: Failures related to protecting software and data from unauthorized modification, such as insecure deserialization or updating software from untrusted sources.
- A09:2021 - Security Logging and Monitoring Failures: Insufficient logging, monitoring, or alerting to detect and respond to attacks in a timely manner.
- A10:2021 - Server-Side Request Forgery (SSRF): Flaws that allow an attacker to induce a server-side application to make requests to an unintended location.
Test your understanding!
A penetration tester discovers that by modifying the URL from https://example.com/orders?id=101 to https://example.com/orders?id=102, they can view an order that does not belong to them. Which OWASP Top 10 category does this vulnerability fall under, and why?
Show answer
This vulnerability falls under A01:2021 - Broken Access Control. The application authenticates the user (knows who they are) but fails to authorize their request (check if they are allowed to see order #102). The system is insecurely trusting the ID provided in the URL without verifying ownership. This is a classic example of what was formerly called an "Insecure Direct Object Reference" (IDOR).
From Theory to Practice: The OWASP Top 10 in ASP.NET
This list of ten categories provides the structure for this course. Your initial goal—fixing an XSS vulnerability—falls squarely under A03: Injection. Other common issues found in VA reports, like SQL Injection, also belong here. As we progress, we will touch on many of the other categories.
To make this immediately practical for you as a C# developer, let's look at a resource that maps these abstract categories to concrete code and practices in the .NET world.
DotNet Security - OWASP Cheat Sheet Series
The OWASP foundation maintains "cheat sheets" for various technologies. The ".NET Security Cheat Sheet" is an invaluable resource that connects the Top 10 risks to specific code patterns and solutions in C# and ASP.NET.
Please read the introduction section titled ".NET General Guidance" and then skim the first few categories, such as "A01 Broken Access Control" and "A03 Injection." You don't need to understand every detail yet. The goal is to see how each Top 10 item is followed by specific DO and DO NOT advice with C# code examples relevant to your work.
As you can see, the cheat sheet provides specific, actionable guidance. For example, under "A03 Injection," it immediately recommends using parameterized queries to prevent SQL Injection and shows a code snippet for doing so with Entity Framework. This is the level of practical detail we will be aiming for throughout this course.
Conclusion
In this lesson, we've put a name and a structure to the world of web application security risks.
Here are the key takeaways:
- The OWASP Top 10 is a standard awareness document that identifies the ten most critical security risks to web applications.
- It serves as a prioritization tool for developers, helping them focus on the most common and impactful vulnerabilities.
- The 2021 list includes categories like Broken Access Control, Injection (which includes XSS), and Security Misconfiguration.
- These categories are not just theoretical; they map directly to specific coding practices and architectural decisions in your ASP.NET MVC projects.
We have now covered the "why" (the VA process) and the "what" (the OWASP Top 10). In the next lesson, we will synthesize these ideas and describe a typical workflow for identifying, reporting, and remediating security vulnerabilities, bringing the process to life from start to finish.