The OWASP Top 10 is a community-maintained awareness document listing the most critical security risks to web applications. It is not a standard or a checklist of every possible bug; it is a ranked list of risk categories, refreshed every few years from vulnerability data contributed by security firms and a community survey. Developers use it to prioritise secure coding, testers use it to structure assessments, and many compliance programmes reference it.
This page is the concept layer. The individual attack techniques (injection, XSS, CSRF, SSRF, traversal) are explained once in Application Attacks. Step-by-step labs live in the TryHackMe notes linked at the end.
OWASP Top 10:2021
| # | Category | What it means | Typical example | Key mitigation |
|---|---|---|---|---|
| A01 | Broken Access Control | Users can act outside their intended permissions | Changing ?id=1001 to ?id=1002 to read someone else's order (IDOR) | Enforce authorisation server-side on every request; deny by default |
| A02 | Cryptographic Failures | Sensitive data is not protected, or weak crypto is used | Passwords stored as unsalted MD5; traffic over plain HTTP | TLS everywhere; strong algorithms; proper key management; modern password hashing |
| A03 | Injection | Untrusted input is interpreted as code or commands | SQL injection, OS command injection, XSS | Parameterised queries; input validation; output encoding |
| A04 | Insecure Design | The design itself lacks security controls (not an implementation bug) | A password-reset flow with no rate limit or identity check | Threat modelling; secure design patterns; abuse-case testing |
| A05 | Security Misconfiguration | Insecure defaults, unnecessary features, verbose errors | Default admin credentials; directory listing enabled; stack traces shown to users | Hardened baselines; remove unused features; automated config review |
| A06 | Vulnerable and Outdated Components | Using libraries or platforms with known flaws | An unpatched framework with a public CVE | Inventory dependencies; patch regularly; software composition analysis |
| A07 | Identification and Authentication Failures | Weak login, session, or credential handling | No lockout on login; guessable session IDs; credential stuffing succeeds | MFA; rate limiting; secure session management; breached-password checks |
| A08 | Software and Data Integrity Failures | Code or data is trusted without verifying integrity | Auto-updates without signature checks; insecure deserialisation | Signed artefacts; verified pipelines; avoid deserialising untrusted data |
| A09 | Security Logging and Monitoring Failures | Attacks cannot be detected or investigated | Failed logins not logged; no alerting on suspicious activity | Log security events centrally; alert; retain logs; test detection |
| A10 | Server-Side Request Forgery (SSRF) | The server is tricked into making requests on the attacker's behalf | A URL-fetch feature used to reach internal metadata services | Allow-list outbound destinations; block internal ranges; segment the network |
How the categories map to attack write-ups
| OWASP category | Where the technique is explained |
|---|---|
| A01 Broken Access Control | Parameter tampering and directory traversal in Application Attacks |
| A03 Injection | Injection flaws and Cross-Site Scripting in Application Attacks |
| A10 SSRF | Server-Side Request Forgery in Application Attacks |
| A02 Cryptographic Failures | Cryptography Fundamentals, Cryptographic Solutions |
| A06 Vulnerable Components | Vulnerability and Patch Management |
| A09 Logging and Monitoring | SIEM and Log Management |
OWASP Top 10:2025 — What Changed
The TryHackMe study notes for the 2025 edition describe the following categories, with the labels used there:
| Category (2025 notes) | Note |
|---|---|
| Broken Access Control | Still first |
| Security Misconfiguration | Moved up relative to 2021 |
| Software Supply Chain Failures | Broader than "Vulnerable and Outdated Components"; the SolarWinds compromise is the cited example |
| Cryptographic Failures | Retained |
| Injection | Retained |
| Insecure Design | Retained |
| Authentication Failures | Renamed from "Identification and Authentication Failures" |
| Software or Data Integrity Failures | Retained |
| Logging and Alerting Failures | Renamed from "Logging and Monitoring Failures" |
The notes group these into three themes — application design flaws, identity/authentication/authorisation failures, and insecure data handling — and describe nine categories. Verify the complete and current ranking on the official OWASP site before citing it, as the list is revised periodically.
The shift that matters most in practice: supply chain risk is now treated as its own category, reflecting incidents where a trusted vendor or dependency was the entry point rather than the application's own code.
Using the Top 10 well
- It is a starting point, not a ceiling. Passing a "Top 10" review does not make an application secure.
- Map findings to categories in pentest and code-review reports so developers can see patterns, not just individual bugs.
- Shift left. Most categories are cheaper to fix at design and coding time. See Secure Software Development.
- Test continuously. Combine automated scanning with manual testing and a proxy tool for the logic flaws scanners miss.
Related
- Application Attacks — injection, XSS, CSRF, SSRF, traversal explained
- Application Security Roadmap — a learning path through AppSec
- Secure Software Development — building these defences in
- Threat Modeling — addressing Insecure Design early
- TryHackMe labs: OWASP Top 10 (2021), 2025: Application Design Flaws, 2025: IAAA Failures, 2025: Insecure Data Handling, IDOR, SQL Injection