Web Application Security

Web application security focuses on securing websites, web applications, and web services from various cyber threats. This section covers common web vulnerabilities, their detection methods, and prevention strategies.

6 topics, 14 scripts

Cross-Site Request Forgery (CSRF)
Draft
CSRF tricks a logged-in user's browser into sending a state-changing request (change email, transfer money) to a site that trusts the session cookie. The server sees a valid cookie and cannot tell the user did not intend the action.
- CWE-352
2 scriptsReviewed Oct 11, 2026
Cross-Site Scripting (XSS)
Not reviewed
Cross-Site Scripting (XSS) is a client-side code injection attack where attackers inject malicious scripts into trusted websites. When users visit the compromised page, the script executes in their browser, potentially stealing cookies, session tokens, or performing actions on their behalf.
3 scriptsNot yet reviewed
File Inclusion and Path Traversal
Draft
File inclusion bugs let a user control which file the server reads or executes. Local file inclusion (LFI) and path traversal expose files such as configuration and password files; remote file inclusion (RFI) can make the server run an attacker's code.
- T1190
- CWE-22
- CWE-98
2 scriptsReviewed Oct 11, 2026
Security Misconfiguration
Draft
Security misconfiguration is any insecure setting that the software allows: default credentials, unnecessary services, verbose errors, exposed admin panels or files, missing security headers, over-permissive cloud storage or firewall rules.
- A02:2025
- T1190
- CWE-16
1 scriptReviewed Oct 11, 2026
Session Hijacking and Fixation
Draft
Session hijacking is taking over another user's authenticated session by stealing or guessing the session identifier. Session fixation is the reverse: the attacker plants a known identifier before the user logs in and reuses it afterwards.
- T1539
- CWE-384
- CWE-613
2 scriptsReviewed Oct 11, 2026
SQL Injection
Reviewed
SQL injection happens when an application builds a database query by pasting user input into SQL text. The database cannot tell which part the developer wrote and which part the attacker supplied, so the attacker can change what the query does.
- A05:2025
- T1190
- CWE-89
4 scriptsReviewed Oct 10, 2026

Read the full category guide

Back to Main

Overview

Categories Covered

SQL Injection
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF) (planned)
Session Hijacking (planned)
File Inclusion Vulnerabilities (planned)
Security Misconfiguration (planned)

OWASP Top 10:2025

The current list, published by OWASP in late 2025. Categories that map to a topic in this repository are linked.

Rank	Category	What it covers
A01	Broken Access Control	Users act outside their permissions; now also includes server-side request forgery (SSRF)
A02	Security Misconfiguration	Insecure defaults, unnecessary features, exposed admin interfaces
A03	Software Supply Chain Failures	Compromised dependencies, build systems and distribution channels
A04	Cryptographic Failures	Weak or missing encryption, exposed sensitive data
A05	Injection	SQL, NoSQL, OS command injection and cross-site scripting
A06	Insecure Design	Missing security controls at the design stage
A07	Authentication Failures	Weak login, session and credential handling
A08	Software or Data Integrity Failures	Unverified updates, plugins and CI/CD pipeline changes
A09	Security Logging and Alerting Failures	Missing logs and alerts, so attacks go unnoticed
A10	Mishandling of Exceptional Conditions	Errors and failures handled in ways that expose data or break security checks

Source: owasp.org/Top10/2025. Last reviewed 2026-10-10. Earlier versions of this page showed the 2021 list.

Quick Start

# Navigate to specific vulnerability directory
cd sql-injection/detection/

# Run vulnerability scanner
python3 sql_injection_detector.py -u http://testphp.vulnweb.com/artists.php

# Check prevention examples
cd ../prevention/
python3 parameterized_queries.py

Web Security Testing Tools

Automated Scanners

OWASP ZAP – Open source web application security scanner
Burp Suite – Web vulnerability scanner and testing platform
Nuclei – Fast template-based vulnerability scanner
Arachni – Feature-rich web application security scanner

Manual Testing Tools

cURL – Command-line tool for making HTTP requests
Postman – API development and testing platform
Wireshark – Network protocol analyzer and traffic analysis tool
Browser DevTools – Built-in browser tools for client-side debugging (Chrome, Firefox, Edge)

Security Testing Methodology

Reconnaissance → Scanning → Vulnerability Assessment → Exploitation (Ethical) → Reporting → Remediation

Best Practices

Development Phase

Secure Coding – Follow OWASP secure coding guidelines
Input Validation – Validate all user inputs
Output Encoding – Prevent XSS attacks
Parameterized Queries – Prevent SQL injection
CSRF Tokens – Protect state-changing operations

Deployment Phase

Security Headers – Implement CSP, HSTS, X-Frame-Options
HTTPS Everywhere – Encrypt all traffic
Least Privilege – Grant minimal required permissions
Regular Updates – Apply patches and updates consistently
Web Application Firewall (WAF) – Deploy WAF protection

Maintenance Phase

Regular Scanning – Perform automated vulnerability scans
Penetration Testing – Conduct manual security testing
Bug Bounty Program – Enable crowdsourced security testing
Security Training – Provide ongoing developer education
Incident Response – Prepare and test breach response plans

Important Notes

Always obtain proper authorization before testing
Use isolated testing environments
Document all findings responsibly
Follow responsible disclosure practices
Some tools may trigger security alerts

Additional Resources

Learning Platforms

Source folder: 02-web-application-security