🛡️ OWASP Top 10 Vocabulary

Injection (A03 in OWASP Top 10 2021, formerly A01) occurs when untrusted data is sent to an interpreter as part of a command or query.

OWASP Category	Key signal	Classic example
Injection	Input interpolated into a query or command	SQL injection, command injection, LDAP injection
Broken Authentication	Weak session management, password handling	Credential stuffing, session fixation
Security Misconfiguration	Default credentials, debugging enabled in production	Debug endpoints exposed, S3 bucket public
IDOR	Direct reference to internal objects without authorisation check	/api/invoice/1042 accessible by any user

Key vocabulary:

• Interpolated directly — user input inserted into a string that becomes a SQL command without escaping or parameterisation
• Untrusted input — data originating from user-controlled sources that cannot be trusted to be safe
• Parameterised query (prepared statement) — the mitigation: bind user input as typed parameters, never as SQL text

BOLA (Broken Object Level Authorisation), also known as IDOR (Insecure Direct Object Reference), is OWASP API Security Top 10 #1.

Term	Meaning
BOLA	Broken Object Level Authorisation — the OWASP API Security term
IDOR	Insecure Direct Object Reference — the classic OWASP Web Top 10 term for the same pattern
Horizontal privilege escalation	Attacker accesses another user's data at the same privilege level (not admin escalation)
Authorisation check missing	The server fetches the resource but does not verify resource.ownerId === currentUser.id

Root cause: The API trusts the client-supplied ID rather than scoping queries to the authenticated user. Fix: always add an ownership check before returning any resource.

Key vocabulary: "without verifying ownership", "horizontal privilege escalation", "authorisation check missing", "object-level access control".

Security Misconfiguration (A05 in OWASP 2021) covers all of these signals: verbose error output, debugging enabled in production, and unpatched 3rd-party software.

Signal in finding	Security Misconfiguration sub-type
Full stack trace in 500 errors	Verbose error messages — information disclosure through misconfigured error handling
Database schema details exposed	Sensitive internal data leaked through error pages — aids attacker reconnaissance
Debugging enabled in production	Unnecessary features enabled — debug endpoints, verbose logging, test pages
Unpatched nginx version	Vulnerable Components — also covered by A06 "Vulnerable and Outdated Components"

Key vocabulary: "stack trace disclosure", "verbose errors in production", "debugging enabled", "unnecessary features", "default configuration", "unpatched components".

The OWASP Top 10 is a community-driven awareness document, not a checklist, certification, or scoring system.

• OWASP — Open Web Application Security Project: a non-profit foundation producing free, open security resources
• Top 10 purpose — raise awareness of the most critical risks; often used as a baseline for application security requirements
• Not a certification — OWASP produces certifications separately (e.g., OSCP is from Offensive Security, not OWASP)
• Not a scoring system — severity scoring is done by CVSS (Common Vulnerability Scoring System)
• Updated periodically — major versions in 2010, 2013, 2017, 2021; categories shift based on data from thousands of organisations

How it is used in practice: Product security requirements ("our application must have no OWASP Top 10 vulnerabilities"), developer training, and as a reference in security assessments and audits.

XSS (Cross-Site Scripting) = injecting malicious client-side scripts into pages viewed by other users.

Vulnerability	What is injected	Where it runs
XSS	Client-side scripts (JavaScript)	Victim's browser — steals cookies, redirects, keyloggers
SQL Injection	SQL commands	Database server — reads, modifies, or deletes data
CSRF	Forged HTTP requests	Victim's authenticated session — performs actions as the user
RCE	Arbitrary code / exploits	Server-side — attacker gains control of the server process

XSS types: Stored XSS (payload saved in database, served to all users); Reflected XSS (payload in URL, reflected back in response); DOM-based XSS (payload manipulates the DOM client-side).

Key vocabulary: "malicious scripts", "client-side injection", "script injection", "cookie theft", "session hijacking via XSS".

Rate limiting is crucial in mitigating brute-force attacks. While basic input validation is a step in the right direction, without controlling the *rate* of requests, an attacker could repeatedly attempt to guess passwords. The question focuses on proactively preventing malicious activity rather than simply reacting to it after an attack has commenced.

Broken Authentication vulnerabilities occur when authentication mechanisms fail to properly validate credentials or tokens. An attacker exploiting this flaw can bypass security controls and gain unauthorized access. The description focuses on how a malicious token could be used to circumvent access restrictions, a core element of this vulnerability.

Detailed error logs, especially those containing stack traces or database schema information, can be a significant security risk. Attackers can leverage this information to understand the application's architecture and identify potential vulnerabilities. While helpful for debugging, exposing such details in production environments increases the attack surface.

The *OWASP Top 10* is fundamentally a prioritization tool. It's not a detailed technical specification, but rather a ranked list of the most impactful vulnerabilities that developers should address first. Understanding this core function – prioritization – is key to using the Top 10 effectively.

Cross-Site Scripting (XSS) vulnerabilities occur when untrusted data is injected into a web page and executed by the user's browser. The scenario clearly describes an attacker injecting JavaScript code that runs in the context of other users' sessions, allowing them to perform malicious actions.

Rate limiting is crucial in mitigating brute-force attacks. While basic input validation is a step in the right direction, without controlling the *rate* of requests, an attacker could repeatedly attempt to guess passwords. The question focuses on proactively preventing malicious activity rather than simply reacting to it after an attack has commenced.

Broken Authentication vulnerabilities occur when authentication mechanisms fail to properly validate credentials or tokens. An attacker exploiting this flaw can bypass security controls and gain unauthorized access. The description focuses on how a malicious token could be used to circumvent access restrictions, a core element of this vulnerability.

Detailed error logs, especially those containing stack traces or database schema information, can be a significant security risk. Attackers can leverage this information to understand the application's architecture and identify potential vulnerabilities. While helpful for debugging, exposing such details in production environments increases the attack surface.

The *OWASP Top 10* is fundamentally a prioritization tool. It's not a detailed technical specification, but rather a ranked list of the most impactful vulnerabilities that developers should address first. Understanding this core function – prioritization – is key to using the Top 10 effectively.

Cross-Site Scripting (XSS) vulnerabilities occur when untrusted data is injected into a web page and executed by the user's browser. The scenario clearly describes an attacker injecting JavaScript code that runs in the context of other users' sessions, allowing them to perform malicious actions.

Rate limiting is crucial in mitigating brute-force attacks. While basic input validation is a step in the right direction, without controlling the *rate* of requests, an attacker could repeatedly attempt to guess passwords. The question focuses on proactively preventing malicious activity rather than simply reacting to it after an attack has commenced.

Broken Authentication vulnerabilities occur when authentication mechanisms fail to properly validate credentials or tokens. An attacker exploiting this flaw can bypass security controls and gain unauthorized access. The description focuses on how a malicious token could be used to circumvent access restrictions, a core element of this vulnerability.

Detailed error logs, especially those containing stack traces or database schema information, can be a significant security risk. Attackers can leverage this information to understand the application's architecture and identify potential vulnerabilities. While helpful for debugging, exposing such details in production environments increases the attack surface.

The *OWASP Top 10* is fundamentally a prioritization tool. It's not a detailed technical specification, but rather a ranked list of the most impactful vulnerabilities that developers should address first. Understanding this core function – prioritization – is key to using the Top 10 effectively.

Cross-Site Scripting (XSS) vulnerabilities occur when untrusted data is injected into a web page and executed by the user's browser. The scenario clearly describes an attacker injecting JavaScript code that runs in the context of other users' sessions, allowing them to perform malicious actions.

Rate limiting is crucial in mitigating brute-force attacks. While basic input validation is a step in the right direction, without controlling the *rate* of requests, an attacker could repeatedly attempt to guess passwords. The question focuses on proactively preventing malicious activity rather than simply reacting to it after an attack has commenced.

Broken Authentication vulnerabilities occur when authentication mechanisms fail to properly validate credentials or tokens. An attacker exploiting this flaw can bypass security controls and gain unauthorized access. The description focuses on how a malicious token could be used to circumvent access restrictions, a core element of this vulnerability.

Detailed error logs, especially those containing stack traces or database schema information, can be a significant security risk. Attackers can leverage this information to understand the application's architecture and identify potential vulnerabilities. While helpful for debugging, exposing such details in production environments increases the attack surface.

The *OWASP Top 10* is fundamentally a prioritization tool. It's not a detailed technical specification, but rather a ranked list of the most impactful vulnerabilities that developers should address first. Understanding this core function – prioritization – is key to using the Top 10 effectively.

Cross-Site Scripting (XSS) vulnerabilities occur when untrusted data is injected into a web page and executed by the user's browser. The scenario clearly describes an attacker injecting JavaScript code that runs in the context of other users' sessions, allowing them to perform malicious actions.

Rate limiting is crucial in mitigating brute-force attacks. While basic input validation is a step in the right direction, without controlling the *rate* of requests, an attacker could repeatedly attempt to guess passwords. The question focuses on proactively preventing malicious activity rather than simply reacting to it after an attack has commenced.

Broken Authentication vulnerabilities occur when authentication mechanisms fail to properly validate credentials or tokens. An attacker exploiting this flaw can bypass security controls and gain unauthorized access. The description focuses on how a malicious token could be used to circumvent access restrictions, a core element of this vulnerability.

Detailed error logs, especially those containing stack traces or database schema information, can be a significant security risk. Attackers can leverage this information to understand the application's architecture and identify potential vulnerabilities. While helpful for debugging, exposing such details in production environments increases the attack surface.

The *OWASP Top 10* is fundamentally a prioritization tool. It's not a detailed technical specification, but rather a ranked list of the most impactful vulnerabilities that developers should address first. Understanding this core function – prioritization – is key to using the Top 10 effectively.

Cross-Site Scripting (XSS) vulnerabilities occur when untrusted data is injected into a web page and executed by the user's browser. The scenario clearly describes an attacker injecting JavaScript code that runs in the context of other users' sessions, allowing them to perform malicious actions.