OWASP Top 10 vulnerabilities

OWASP( ‘Open web application security project’) is a community and it is a non-profit organization that is primarily oriented towards securing software. Any type of software that we use today, is always prone to vulnerabilities and bugs. These bugs give hackers a chance to proliferate inside the software and steal our precious information. Can we say any of the data that is stored on countless servers and databases is safe? Never…there is always a way to steal your credit card number sitting in a strange server on a strange land. One way of doing it is by exploiting the vulnerabilities or weaknesses in the software that we use everyday…

OWASP lists the top 10 vulnerabilities in application software along with their risks and countermeasures. This helps organizations to ramp up their software by knowing the common vulnerabilities that are being used. This list is updated every 3-4 years and the last list was updated in 2018. 
It is quite that amazing that when I started coding years ago – we were only worried about getting the code to run the way we wanted it to. But now, times have changed and we have to make sure that the code is hack proof in every possible way.. anyways, here are the OWASP top vulnerabilities released in 2018:

1. Injection

        ‘Injection’ may mean different things to people from different walks of life but in our context – ‘injection’ is inputting wrong user  data thereby triggering unintended commands. Some examples of injections can be SQL queries, PHP queries, LDAP queries and more.  ‘Injection’ attacks check if an application is vulnerable or not.

    2. Broken authentication
      We have already discussed authentication in an earlier post.  In a typical authentication scenario, we enter the ‘username’ and ‘password’ and if we enter them correctly, we are authenticated. What happens if somebody steals your session maybe in a shopping conversation with a big online retailer? Maybe you were just authenticated and you finished shopping online. What if somebody steals your financial information with the information you entered last?  This is ‘broken authentication’.
   3. Sensitive data exposure
    Now that online banking and online transactions have all become common place – all usernames and passwords can be sniffed if good encryption is not in place. Just imagine a scenario, wherein your online banking password is sniffed by miscreants! Imagine the damage they can do!! 
  This can be avoided by using the latest encryption algorithms and making sure that none of the information is stored in the cache.
4. XML external entities
  This is known as XXE attacks and these are possible due to the uploading of malicious XML files by the user. Once a malicious file is uploaded to the server, it can be used to steal data and do other malicious things.
5. Broken access control
   I have already written about ‘access control‘ in another post.  ‘Access control’ authorizes users to access the appropriate resources. What if ‘John’ gains ‘admin’ privileges and is able to access your account? Is that right? This is ‘broken access control’. John is not authorized to access your account and he should not be able to access by changing a small piece of code.
This can be prevented by using ‘authorization tokens’.
6. Security  misconfigurations
Security misconfigurations can result from using default ‘security’ settings. 
This can be avoided by configuring all the servers appropriately and preventing wordy error messages.
7. Cross site scripting
Cross site scripting occurs when attackers can insert a piece of code on a web page. This can then be used to steal user data and bring down websites.
8.  Insecure deserialization
Serialization and Deserialization are two processes which happen when dealing with data. This is a type of vulnerability wherein the ‘deserialization’ happens with untrusted sources. 
9. Using Components with known vulnerabilities
It is always possible that web application developers are working with components that have some vulnerabilities in them. The vulnerabilities might have just have been discovered. Once that happens, it is good for application developers to delete such components or install patches immediately.
10. Insufficient logging and monitoring
Many security breaches are detected long after an incident. By this time, hackers can penetrate the system and cause even more damage. In order to minimize extra damage, all activities must be logged and monitored. 
The original set of OWASP top 10 vulnerabilities can be found here