Vulnerability Guides
NoSQL injection: risks for MongoDB and other document databases
NoSQL databases such as MongoDB do not use SQL, but they are still vulnerable to injection. NoSQL injection happens when user input is placed into a database query object or operator, changing what the query does. Many teams assume that moving away ...
Cross-Site Scripting (XSS): reflected, stored and DOM-based
Cross-site scripting (XSS) lets an attacker run their own JavaScript in another user's browser, inside your website. It is one of the most common web vulnerabilities and appears in the OWASP Top 10 under Injection. There are three main types: ...
Blind SQL injection: how it works and how to stop it
SQL injection happens when user input changes the meaning of a database query. In blind SQL injection the application never shows the database error or the query result, yet an attacker can still extract data one piece at a time by watching how the ...
Server-side template injection (SSTI)
Server-side template injection (SSTI) happens when user input is inserted into a server-side template (such as Jinja2, Twig, Freemarker or Velocity) and the template engine evaluates it. SSTI is serious because template engines are powerful: an ...
IDOR and broken object-level authorization (BOLA)
An insecure direct object reference (IDOR) exists when an application uses an identifier from the request, such as /invoice/1042, and returns the object without checking that it belongs to the current user. In APIs the same flaw is called broken ...
Path traversal, local and remote file inclusion
Path traversal lets an attacker read files outside the folder an application intended, using sequences like ../. File inclusion goes further: the application loads and sometimes executes the file, either from the server itself (local file inclusion, ...
Insecure file upload
File upload features, such as avatars, attachments and document imports, are a favourite target. If the server trusts the file name, extension or content type sent by the browser, an attacker can upload something far more dangerous than a picture. ...
Cross-site request forgery (CSRF)
Cross-site request forgery (CSRF) makes a logged-in user's browser send a request they did not intend, such as changing their email address or transferring money. The browser automatically attaches the user's cookies, so the application thinks the ...
JSON Web Token (JWT) vulnerabilities
JSON Web Tokens (JWTs) carry identity and permissions between a client and an API. They are signed, not encrypted, and their security depends entirely on how the server validates them. Small validation mistakes let an attacker forge a token and ...
Insecure deserialization
Deserialization turns stored or transmitted data back into objects. When an application deserializes data an attacker can control, using formats such as Java serialization, PHP serialize, Python pickle or .NET formatters, the attacker may be able to ...
HTTP request smuggling
HTTP request smuggling exploits disagreements between a front-end server (such as a load balancer or CDN) and a back-end server about where one request ends and the next begins. An attacker can "smuggle" a hidden request that the back end processes ...
Open redirect vulnerabilities
An open redirect happens when an application sends users to a URL taken from a parameter, such as ?next= or ?returnUrl=, without checking it. It looks minor, but attackers use it to make phishing links look trustworthy, and it can help steal OAuth ...
CORS misconfiguration
Cross-Origin Resource Sharing (CORS) tells browsers which other websites may read responses from your API. A misconfigured CORS policy can let any website read your users' private data through their own browser. How it happens The most common ...
Server-side request forgery (SSRF) and cloud metadata attacks
Server-side request forgery (SSRF) tricks your server into making HTTP requests on the attacker's behalf. Because the request comes from inside your network, it can reach systems the attacker cannot reach directly. In cloud environments SSRF is ...
Web security issues you need to be concerned about
These five web security issues affect a large number of websites. For each one, this article explains what it is and how to prevent it. 1. SQL injection (SQLi) In an SQL injection attack, malicious input changes a database query. Attackers use it to ...
Common website vulnerabilities
These are some of the vulnerabilities most often found when websites are scanned. Developers should plan to prevent each of them from the start of a project. 1. SQL injection An attacker uses application input to change a database query. If ...
OWASP Top 10: the most critical web application security risks
The OWASP Top 10 is an awareness document for web application security, published by the Open Worldwide Application Security Project (OWASP). It represents a broad consensus among security experts about the most critical security risks to web ...
OWASP Top 10 2017 and what changed in 2021
OWASP updates its Top 10 list of web application security risks every few years. This article shows the 2017 list and how it changed in the 2021 edition, which is the current one. The OWASP Top 10 2017 A1:2017 Injection A2:2017 Broken Authentication ...
OS command injection: how it works and how to prevent it
Command injection is an attack in which the attacker runs arbitrary operating-system commands on the server through a vulnerable application. It is possible when an application passes unsafe user-supplied data, from forms, cookies or HTTP headers, to ...
DOM-based XSS (DOM XSS) explained
DOM-based cross-site scripting (DOM XSS) is a type of XSS where the vulnerability is in the page's own client-side JavaScript. The script reads data from a source the attacker can control, such as the URL, and writes it into the page in an unsafe ...
XML External Entity (XXE) injection
XML External Entity (XXE) injection is an attack against applications that parse XML input. If the XML parser is configured to process external entities, an attacker can make it read local files, send requests to internal systems, or exhaust server ...
Subdomain takeover
A subdomain takeover happens when a subdomain of your site points to an external service that no longer exists, and an attacker claims that service. The attacker then controls what visitors to your subdomain see. How it happens Suppose your main ...
HTTP parameter pollution (HPP)
HTTP parameter pollution (HPP) is an attack where the same parameter is sent more than once in a request. Different parts of a system may handle the duplicates differently, and an attacker can use that to bypass validation or change the application's ...
Error-based SQL injection
SQL injection lets an attacker change a database query by supplying crafted input. There are three common techniques: union-based, error-based and blind SQL injection. This article covers the error-based technique. How it works A common first test ...
Insecure data storage in mobile apps
Insecure data storage is one of the risks in the OWASP Mobile Top 10. It happens when a mobile app stores sensitive information, such as usernames, passwords or card numbers, in a place where other apps or anyone with access to the device can read ...