OWASP Top 10

1. Injection – SQL, XML
2. Cross-site scripting – data context leaking into the xml context –
3. Broken authentication and session management
4. Insecure direct object reference – where a hacker can get to assets against which they are authenticated but not authorised. mitigation: user access controls, indirect references
5. Cross site forgery request – you go to evil. HTML. In that page is eg an image tag which contains a link to an instruction to a bank to withdraw money from your account. For it to work you must be logged in and authenticated against the bank. It feels like a very targeted hit as the hacker needs to know the page to hit surely.
Mitigation is anti-forgery tokens
6. Security misconfiguration:

tracing still on, custom errors off

7. insecure cryptography

hashing, salts, sha1, google, 1000 repetitions, encyrption, data protection layer – issue if the app server gets stolen, but OK if the database is stolen. Encoding is not encryption, Character rotation is not encyrption

9. Insufficient cryptographic transport… and storage?

10. Unvalidated redirects


Hm… changed for 2013:



Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s