Saltar al contenido
AKOS
Todos los packs
StableSeguridadowasp-top-10

OWASP Top 10

Operationalizes the OWASP Top 10 web application security risks as concrete build and review rules — the baseline every web-facing application must clear regardless of reasoning profile beyond Prototype.

securityowaspinjectionaccess-controlauthenticationssrf

Principios

  • · A01 Broken Access Control: enforce authorization server-side on every request, by default deny; never trust client-supplied role/ID claims; check ownership on every object access (IDOR prevention).
  • · A06 Vulnerable and Outdated Components: track dependency versions and known CVEs; patch promptly; remove unused dependencies; prefer actively maintained libraries.
  • · A08 Software and Data Integrity Failures: verify signatures/checksums on updates and CI artifacts; never deserialize untrusted data without strict type/schema constraints; pin CI/CD dependencies.
  • · A10 SSRF: validate and allowlist any server-side outbound request destinations built from user input; never let user input directly control internal-network-reachable URLs.

Patrones

  • · The string-concatenation grep: search for SQL/shell/command strings built via concatenation or template literals with variables — nearly always A03 if the variable comes from user input.
  • · The "guess the ID" test: change a numeric/UUID ID in a request to another user's resource ID — does the server return their data? That's IDOR (A01).
  • · The error-message test: trigger a 500 error deliberately — does the response leak a stack trace, file path, or internal library version to the client? A05.
  • · The dependency-audit reflex: run npm audit/pip-audit/equivalent before every release; treat critical/high CVEs in production dependencies as release blockers, not backlog items.
  • · The "logged in as who" test: after logout, is the old session/token still valid? A07.

Riesgos

  • · Ver anti-patrones específicos del dominio en el pack.

Checklist

  • [ ] Server-side authorization enforced on every data-scoped request; ownership verified, not assumed. (OW1)
  • [ ] Passwords stored via modern adaptive hash; never plaintext/reversible/fast-hash. (OW2)
  • [ ] All DB queries parameterized; no string-concatenated SQL. (OW3)
  • [ ] All shell/command execution with user input uses safe argument passing. (OW4)
  • [ ] Client-facing errors never leak stack traces/internals. (OW8)
  • [ ] Brute-force protection on all authentication endpoints. (OW11)

Fuentes

En la bibliografía AKOS

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

Explorar todas las fuentes →