OWASP Top 10: Comprehensive Web Application Security

Explore the 2021 OWASP top ten web vulnerabilities, including broken access control, cryptographic failures, and server-side request forgery, and learn attacker techniques like injection and cross-site scripting.

Explore command injection, a critical web-application flaw that lets attackers abuse scripts to run commands on the hosting server, via http headers, and warn about shellshock and input validation.

Demonstrates a command injection vulnerability by chaining commands, where the server runs ping first and then cat /etc/password via the input field in the DVWA demo.

Demonstrates a command injection that enables code execution by sending a bash shell via netcat to the attacker through a vulnerable app, enabling commands like listing users and network interfaces.

Explore SQL injection techniques that trick web apps into sending unintended database queries, covering error-based and blind types and methods like 1=1 bypass.

Demonstrates a sql injection attack on a web form to extract user data. Shows how union queries and information_schema reveal user IDs, names, and passwords.

Explore the blind SQL injection demo to identify vulnerabilities using boolean checks that reveal user existence. Enumerate the database name and other information through crafted payloads and responses.

Protect against cross-site request forgery by understanding how sessions and browser trust enable attackers to change account details or transfer funds, requiring attacker-crafted requests and user trickery.

This csrf demo shows how an attacker can change an admin password via a forged request without re-authenticating, highlighting the role of csrf tokens in preventing such attacks.

Explains information disclosure weaknesses in web apps, showing how exposed server versions, verbose errors, code comments, or HTML5 storage tokens reveal sensitive details, and reinforces least-privilege practices.

Explore path traversal and file inclusion theory, showing how directory navigation tricks like double dots expose sensitive data or enable code execution via include functions and web shells.

Demonstrate path traversal and file inclusion vulnerability by manipulating the page parameter to load files from parent folders, exposing the web server root and password file.

Demonstrates remote code execution using a webshell uploaded via file upload and local file inclusion, showing how a backdoor can execute system commands and access sensitive information.

Explore session management concepts across authentication schemes from basic and digest to mfa, cookie-based sessions, and identify flaws such as weak session ids, brute-force risks, and insecure password reset links.

Explore how weak session IDs can be predicted and hijacked by fuzzing requests, removing cookies, and iterating session values to identify valid sessions.

Explore how XML external entities injection exploits external entities in XML applications and web services, revealing risks of local file access and server-side request forgery.

Demonstrate an external entity injection (xee) against a web app to access system users and reveal internal files via an xml payload.

Explore reconnaissance as gathering publicly available domain data, including whois and registrar details. Use tools to detect DNS records, emails, and open ports, test WAF and TLS settings with OpenSSL.

Use whois to reveal domain ownership details and name servers, then perform dns reconnaissance for records and zone transfers, and try the harvester to uncover public social media accounts.

Explore reconnaissance tools such as recon-ng to load modules and retrieve domain, host, and subdomain information, then use nmap to identify open ports, services, and operating systems.

Demonstrates wafw00f, a web application firewall fingerprinting toolkit, to reveal protection behind a WAF. Use openssl s_client to inspect certificates and TLS versions.

Explore the DNS security course for a practical overview and deepen cybersecurity knowledge, while you can ask questions or share improvements via the website or Twitter.