The 10 Most Common Web Attacks (OWASP Top 10)

Why this matters

The Top 10 is the most-cited list in web security, updated every few years from a meta-analysis of real-world data. It's not the canon, it's the consensus — what most teams will encounter most often. Knowing it cold means you can read a bug report and immediately know what category you're in, which past incident is similar, and what the standard mitigations are.

Demo

The 2021 list, in order: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Identification/Authn Failures, A08 Software & Data Integrity Failures, A09 Logging Failures, A10 SSRF. Each has a cluster of CWEs underneath.

Try it yourself

1. Read the OWASP Top 10 2021 once, then close the tab and write the ten categories from memory. Check what you missed.
2. For each category, write one example you've seen (in your code, a CVE, a bug bounty writeup).
3. Build a checklist: 'before merging, have I considered each of these ten?'. Tape it to your monitor for a week.

References

• OWASP Top 10 — 2021
• OWASP — ASVS (Application Security Verification Standard)