OWASP Top 10 Analysis

Work a web application category-by-category so nothing is skipped.

Checklist by Category (2021)

A01 Broken Access Control

• Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts
• Verify server-side enforcement on every endpoint, not just UI hiding
• Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates
• Check forced browsing to admin routes after logout/role downgrade

A02 Cryptographic Failures

• Confirm TLS 1.2+ only, HSTS present
• Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords
• Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles

A03 Injection

• SQL/NoSQL/ORM injection: parameterized queries verified; test in sort/filter/order params, not just search
• OS command injection in file upload/filename handling, image processing, PDF generators
• Header injection, template injection (SSTI) in email/render features

A04 Insecure Design

• Business logic abuse: negative quantities, currency confusion, race conditions on credits/coupons
• Trust-boundary violations: client-computed prices, unsigned discount tokens

A05 Security Misconfiguration

• Debug modes, default credentials, verbose errors, directory listing
• Unnecessary features enabled (PUT, TRACE), permissive CORS (* with credentials)

A06 Vulnerable Components

• SBOM against known CVEs; flag unmanaged/EOL dependencies
• Check client-side libs too (npm audit / Retire.js signals)

A07 Authentication Failures

• Credential stuffing resistance (rate limiting, MFA), session fixation, weak password policy
• Session tokens: rotated on login, invalidated on logout, secure/httpOnly flags
• MFA bypass flows: reset, backup codes, OAuth account linking

A08 Integrity Failures

• Unsigned updates/deserialization of untrusted data (pick your targets: memcached, JWT, file parsers)
• CI/CD pipeline: pinned dependencies, verified provenance

A09 Logging & Monitoring

• Auth events, access-control denials, and input-validation failures are logged with context
• Logs don't contain passwords/tokens; alerting exists for brute force

A10 SSRF

• Any URL-fetch feature (webhooks, importers, preview generators): test localhost, link-local (169.254.169.254), IPv6 equivalents, DNS rebinding
• Scheme and redirect handling enforced server-side

Output

Per finding: category, evidence, reproduction, severity, fix. Note verified-negatives per category for coverage evidence.