Dashboard: OWASP Top 10 2021
To obtain the latest version of this official guide, please visit https://owasp.org/Top10/.
Overview
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
- A01:2021-Broken Access Control - Vulnerabilities that allow unauthorized users to access restricted functionality or data.
- A02:2021-Cryptographic Failures - Failures to properly implement encryption, resulting in sensitive data exposure.
- A03:2021-Injection - When untrusted data is sent to an interpreter as part of a command or query, allowing attackers to execute unintended commands.
- A04:2021-Insecure Design - Security flaws that exist due to poor design choices before any code is written.
- A05:2021-Security Misconfiguration - Improperly configured applications, frameworks, servers, or platforms that leave security gaps.
- A06:2021-Vulnerable and Outdated Components - Using components with known vulnerabilities or failing to keep software updated.
- A07:2021-Identification and Authentication Failures - Weaknesses in authentication mechanisms that allow account compromise.
- A08:2021-Software and Data Integrity Failures - Code and infrastructure that doesn't protect against integrity violations, such as using untrusted plugins or libraries.
- A09:2021-Security Logging and Monitoring Failures - Insufficient logging, monitoring, and incident response capabilities that prevent timely detection of attacks.
- A10:2021-Server-Side Request Forgery (SSRF) - Flaws that allow attackers to induce the server-side application to make requests to unintended locations.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/tailpipe-mod-apache-access-log-detections
Start the Powerpipe server:
powerpipe server
Open http://localhost:9033 in your browser and select OWASP Top 10 2021 dashboard.
You could also snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe benchmark run apache_access_log_detections.benchmark.owasp_top_10_2021 --share
Benchmark
This dashboard is automatically generated from the following benchmark:
benchmark.owasp_top_10_2021