OWASP’s Top Ten Vulns

And their application to pentesting and software development.

Who Is OWASP

Their application to Software Development.

The top 10 vulns.

Their Application To Pentesting

02

01

04

03

Who is OWASP, and why do we care what they think?

Why do they matter to you as a software developer.

The top 10 vulns, and why they matter.

Why do they matter to you as a pentester?

Who is OWASP

The Open Web Application Security Project^® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web.

• Tools and Resources
• Community and Networking
• Education & Training

​

The Top 10 Vulns

Injection

1

Broken Authentication.

Sensitive Data Exposure

XML External Entities

2

3

4

5

6

7

8

9

10

Cross Site Scripting (XSS)

Broken Access Control

Using components with known vulnerabilities!

Security misconfiguration

Insecure deserialization

Insufficient logging and monitoring

Injection

1. Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.

How about we define some of the words together like SQL, OS, and LDAP.

• LDAP stands for Lightweight Directory Access Protocol LDAP injection attacks exploit input validation vulnerabilities to inject and execute queries to Lightweight Directory Access Protocol servers. By supplying specially constructed user inputs to a vulnerable application, attackers can extract potentially sensitive information from an organization’s LDAP directory. LDAP services are crucial for the daily operation of many organizations, and a successful LDAP injection attack can provide valuable information for further attacks on systems and applications.

​

• SQL, or Structured Query Language, is a domain-specific language used in programming and designed for managing data held in a relational database management system (RDBMS), or for stream processing in a relational data stream management system (RDSMS). It is particularly useful in handling structured data, i.e. data incorporating relations among entities and variables.�

​

NoSQL, and OS

• NoSQL is (originally referring to "non-SQL" or "non-relational") a database provides a mechanism for storage and retrieval of data that is modeled in means other than the tabular relations used in relational databases. Such databases have existed since the late 1960s, but the name "NoSQL" was only coined in the early 21st century, triggered by the needs of Web 2.0 companies. NoSQL databases are increasingly used in big data and real-time web applications. NoSQL systems are also sometimes called "Not only SQL" to emphasize that they may support SQL-like query languages or sit alongside SQL databases in polyglot-persistent architectures.�
• OS command injection (also known as shell injection) is a web security vulnerability that allows an attacker to execute arbitrary operating system (OS) commands on the server that is running an application, and typically fully compromise the application and all its data. Very often, an attacker can leverage an OS command injection vulnerability to compromise other parts of the hosting infrastructure, exploiting trust relationships to pivot the attack to other systems within the organization.

​

​

​

�

​

​

Broken Authentication

Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.

​

Sensitive Data Exposure

Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. Let’s Define API, and PII.

API and PII

PII

PII is Personally Identifiable Information. Something like your name, or address or email.

​

API

An API is an Application Programming Interface is a computing interface that defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc.

​

XML External Entities

XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.�But what is XML?

• Extensible Markup Language (XML) is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. The World Wide Web Consortium's XML 1.0 Specification of 1998 and several other related specifications—all of them free open standards—define XML. The design goals of XML emphasize simplicity, generality, and usability across the Internet. It is a textual data format with strong support via Unicode for different human languages. Although the design of XML focuses on documents, the language is widely used for the representation of arbitrary data structures such as those used in web services.

​

Broken Access Control

Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.

​

196 Breaches from misconfigurations

Security Misconfiguration

DivvyCloud researchers studied all of the data breaches publicly reported between Jan. 1, 2018, and Dec. 31, 2019 across the globe, finding that 196 separate data breaches were identified as having been definitively caused primarily by cloud misconfigurations.

Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.

​

Cross Site Scripting (XSS)

XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

​

Insecure Deserialization

Insufficient logging and monitoring.

Using components with known vulnerabilities.

And 8, 9, 10

Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including:

• replay attacks
• injection attacks
• privilege escalation attack

Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.

​

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

​

How does this apply to software development?

01

Why does this matter?

Why it matters to software developers.

Knowing what these common vulnerabilities are, are the first steps to preventing it happening on your software such as your web applications.

You don’t want to utilize a library or framework that is known to expose your data, or allow your application to be exploited.

Educating yourself each year on the new top 10 vulnerabilities is important.

You can learn how to prevent these more through the OWASP Cheat Sheet Series.

Why Does It Matter To Pentesters?

Out of all the vulnerabilities pentesters find, these are the most common ones.

Knowing what these vulnerabilities are puts you at an advantage.

Going through and trying every option and giving a full and complete write up to the client is crucial to ensure you don’t miss anything along the way.

​

Reason 1:

Reason 2:

Reason 3:

Summary Time!

Companies Impacted This Year

KingComposer, a WP plugin installed on over 100,000 sites was vulnerable to xss.

For an unknown period of time, all of that web tracking data was left exposed on a server without a password.

Sensitive Data Exposure,this time, hackers obtained login details of two employees and broke into the system in January 2020

While they didn’t disclose the vulnerability, it was through the website.

Wordpress

BlueKai, owned by Oracle.

Marriott

OnePlus

Places you can put this information to practice.

HackTheBox.eu

HackerOne Bug Bounty Program.

CTF Competitions

TryHackMe.org

OverTheWire

BugCrowd

Any Questions?

In 2019

There were 1,506 data breaches that exposed more than 164.68 MILLION people.

These breaches took place in the United States alone.

2018

There was 1.632 breaches, with over 471 million people impacted.

From 2019 on there has been over 4 BILLION records breached.

THANKS!

Do you have any questions?

​

Please feel free to message me in the server @(ASV) Mrs Skelli#9072

Please keep this slide for attribution.

CREDITS: This presentation template was created by Slidesgo, including icons by Flaticon, and infographics & images by Freepik.

​