---
name: owasp-ref
description: OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings. Load when hunting, code-reviewing for security, or writing bug bounty reports.
---

# OWASP Quick Reference

## Web Top 10 (2021)

### A01 — Broken Access Control
**Test ideas:** IDOR on every ID/UUID/slug; force browsing to admin routes; HTTP verb tampering (GET→PUT); JWT role claim tampering; path traversal in file params; CORS misconfig with credentials.
**CWE:** 200, 201, 352, 639.

### A02 — Cryptographic Failures
**Test ideas:** TLS downgrade; weak ciphers; plaintext secrets in responses; ECB mode; static IVs; predictable tokens (timestamp-based); hardcoded keys in JS bundles.
**CWE:** 327, 328, 330, 331.

### A03 — Injection
**Test ideas:** SQLi (error, union, blind, time-based); NoSQLi (`$ne`, `$gt` operators); command injection in filenames/URLs; SSTI (`{{7*7}}`, `${7*7}`); LDAP, XPath, header injection.
**CWE:** 77, 78, 89, 90, 94, 643.

### A04 — Insecure Design
**Test ideas:** Business logic — negative quantities, price tampering, coupon reuse, race conditions on balance operations; missing rate limits on auth/password-reset; workflow skipping.
**CWE:** 209, 256, 501, 522.

### A05 — Security Misconfiguration
**Test ideas:** Default creds; directory listings; `.git`/`.env` exposure; verbose error pages; missing headers (CSP, HSTS, X-Frame-Options); unnecessary HTTP methods; Swagger/actuator endpoints.
**CWE:** 16, 611.

### A06 — Vulnerable and Outdated Components
**Test ideas:** Fingerprint versions via `httpx -tech-detect`; check for known CVEs; look at JS bundle for outdated libraries (jQuery, lodash, moment).
**CWE:** 1104.

### A07 — Identification & Authentication Failures
**Test ideas:** Credential stuffing (no rate limit); weak password reset tokens; JWT `alg: none`; session fixation; 2FA bypass via response manipulation; OAuth `redirect_uri` / `state` issues.
**CWE:** 287, 297, 384, 521.

### A08 — Software & Data Integrity Failures
**Test ideas:** Insecure deserialization (pickle, Java, YAML, PHP); CI/CD supply chain; missing SRI on script tags; auto-update without signature check.
**CWE:** 502, 565.

### A09 — Security Logging & Monitoring Failures
**Test ideas:** Log injection (CRLF in user-controlled log data); log tampering; logs containing secrets.
**CWE:** 117, 532.

### A10 — Server-Side Request Forgery (SSRF)
**Test ideas:** URL fields in webhooks, avatar import, PDF/screenshot gen, SSO metadata; cloud metadata (`169.254.169.254`); DNS rebinding; `file://`, `gopher://`, `dict://`; internal port scan via blind SSRF + timing.
**CWE:** 918.

## API Top 10 (2023)

- **API1** Broken Object Level Auth (BOLA) — IDOR on object refs
- **API2** Broken Authentication — token/key/session flaws
- **API3** Broken Object Property Level Auth — mass assignment, excessive data exposure
- **API4** Unrestricted Resource Consumption — no rate limits, GraphQL depth/alias abuse
- **API5** Broken Function Level Auth — admin endpoints reachable by regular users
- **API6** Unrestricted Access to Sensitive Business Flows — automation abuse (ticket scalping, coupon farming)
- **API7** SSRF
- **API8** Security Misconfiguration
- **API9** Improper Inventory Management — forgotten v1 endpoints, staging APIs in prod DNS
- **API10** Unsafe Consumption of APIs — trusting third-party API responses as safe input

## Testing tips
- **GraphQL:** introspection, batching, alias overloading, depth limits, field suggestions leak schema
- **JWT:** try `alg: none`, `HS256` with public key as secret, `kid` path traversal/injection
- **OAuth:** `redirect_uri` partial matches, missing `state`, authorization code reuse, PKCE downgrade
- **File upload:** double extensions, MIME confusion, SVG with embedded JS, polyglot files, path traversal in filename