Web Application Security: The OWASP Top 10 Vulnerabilities Explained with Examples

Web applications are the most attacked surface in cybersecurity. Every business has a website, most have web-based APIs, and the complexity of modern web stacks creates thousands of potential vulnerabilities. The OWASP Top 10 is the industry-standard list of the most critical web application security risks.

Understanding these vulnerabilities is essential whether you want to defend web applications as a developer, find bugs as a penetration tester, or earn bounties as a bug hunter.

Web Application Security: The OWASP Top 10 (2021) overview

The Open Web Application Security Project (OWASP) publishes the Top 10 every few years based on real-world data from hundreds of organizations:

1. A01: Broken Access Control — users can act beyond their permissions. #1 most common.
2. A02: Cryptographic Failures — sensitive data exposed due to weak or missing encryption.
3. A03: Injection — SQL, NoSQL, OS, LDAP injection through untrusted input.
4. A04: Insecure Design — architectural flaws that no amount of coding fixes.
5. A05: Security Misconfiguration — default creds, unnecessary features, verbose errors.
6. A06: Vulnerable Components — outdated libraries with known CVEs.
7. A07: Authentication Failures — weak login, session management, credential stuffing.
8. A08: Software and Data Integrity — CI/CD pipeline attacks, unsigned updates.
9. A09: Security Logging Failures — attacks go undetected due to poor monitoring.
10. A10: Server-Side Request Forgery (SSRF) — server fetches attacker-controlled URLs.

A01: Broken Access Control — the #1 vulnerability

Broken access control means users can access data or functions they should not. It is the most common vulnerability because it is easy to miss — every endpoint, every parameter, every API call needs access checks.

# Normal request — view your own profile:
GET /api/users/1234/profile
Authorization: Bearer <your-token>
→ 200 OK {name: "Alice", email: "[email protected]"}

# IDOR attack — change the ID to another user:
GET /api/users/1235/profile
Authorization: Bearer <your-token>
→ 200 OK {name: "Bob", email: "[email protected]", ssn: "123-45-6789"}

# The server checked IF you were logged in,
# but NOT if you owned the resource.

# Fix: always check ownership
# if (request.userId != resource.ownerId) return 403;

A05: Security Misconfiguration — low-hanging fruit

Misconfiguration is the easiest vulnerability class to find and exploit. Default credentials, debug modes in production, unnecessary HTTP methods, and verbose error messages are everywhere.

# Check for default credentials:
# admin:admin, admin:password, root:root, test:test

# Check HTTP methods (PUT/DELETE should not be open):
$ curl -X OPTIONS https://target.com -i
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS
# PUT and DELETE open = potential file upload/deletion

# Check for exposed .git directory:
$ curl -s https://target.com/.git/HEAD
ref: refs/heads/main
# If this returns anything → full source code leak!
# Use git-dumper to download the repo

# Check for directory listing:
$ curl -s https://target.com/backup/
# <title>Index of /backup</title>
# database.sql.gz  2024-01-15  45MB  ← game over

# Check for verbose error pages:
$ curl 'https://target.com/api/user?id=\"'
# SQL error: You have an error in your SQL syntax...
# near '"' at line 1  ← reveals database type + query

A10: SSRF — Server-Side Request Forgery

SSRF tricks the server into making requests to internal resources the attacker cannot reach directly. It is increasingly common as applications fetch URLs, process webhooks, and import data from user-provided URLs.

# Application has a URL preview feature:
POST /api/preview
{"url": "https://example.com"}
→ returns page title, description, image

# SSRF attack — access internal services:
POST /api/preview
{"url": "http://169.254.169.254/latest/meta-data/iam/"}
→ returns AWS IAM credentials! (cloud metadata service)

POST /api/preview
{"url": "http://localhost:6379/INFO"}
→ returns Redis server info (internal database)

POST /api/preview
{"url": "http://192.168.1.1/admin"}
→ returns internal router admin panel

# Fix: validate and restrict URLs
# 1. Whitelist allowed domains
# 2. Block private IP ranges (10.x, 172.16.x, 192.168.x)
# 3. Block cloud metadata IPs (169.254.169.254)
# 4. Don't follow redirects (attacker can redirect to internal)

When evaluating web application security, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Frequently asked questions

Should I memorize all OWASP Top 10 details?

Yes — these are the bread and butter of web security. Know each category, understand the attack mechanism, and be able to explain the fix. Interviewers, certifications, and real engagements all test this knowledge.

How do I practice finding web vulnerabilities?

Use DVWA, OWASP WebGoat, and PortSwigger Web Security Academy (free). These have guided exercises for every vulnerability type. Then graduate to HackTheBox and real bug bounty programs.