OWASP Top Ten Project page

https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/

OWASP Top Ten Summary

https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_Top_10.html

A1 - Injections

https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection

• How to test
  • https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection
  • https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/
  • http://sqlmap.org/
• How to prevent
  • https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• Where to practice
  • https://redtiger.labs.overthewire.org/
  • https://www.hacksplaining.com/exercises/sql-injection
  • Your old, not patched router administration panel (PING functionality)

A2 - Broken Authentication

https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A2-Broken_Authentication

• How to test
  • https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
• How to prevent
  • https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret
  • https://owasp.org/www-project-application-security-verification-standard/, section V2: Authentication Verification Requirements
• Where to practice?
  • Just test your own application ;)

A3 - Sensitive Data Exposure

https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A3-Sensitive_Data_Exposure

• How to test
  • https://www.ssllabs.com/ssltest/
  • https://github.com/sullo/nikto
  • https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Protection_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
  • https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
• How to prevent *