Test and fix the OWASP Top 10 2025 in your web app this week

This article provides a practical, week-long testing checklist for the 2025 edition of the OWASP Top 10 security vulnerabilities. The key points are:

1. The official 2025 OWASP Top 10 list is available at owasp.org/Top10/2025 and covers 10 categories: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software/Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.

2. SSRF (Server-Side Request Forgery) has been folded into the Broken Access Control category. To test for Broken Access Control, create accounts for two users (Alice and Bob) and an admin in a staging environment. Then attempt to:

- Open Bob's account by manipulating IDs in the URL or JSON.

- Access admin pages/APIs with Alice's credentials instead of the admin's.

- Call role/change owner endpoints as Alice.

- Re-login and see if Alice's session remains valid.

A clean result is a consistent 403 or 404 response. If Bob's data is exposed or the admin page loads, it indicates a Broken Access Control failure.

3. To test for SSRF, point the app at a publicly accessible URL (controlled by you) and ensure it cannot reach internal addresses like localhost or internal services. Check response headers for missing Secure and HttpOnly flags, and verify proper TLS configuration and secure password storage.

4. The other 9 categories (Security Misconfiguration, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software/Data Integrity Failures, Logging and Alerting Failures, and Mishandling of Exceptional Conditions) follow the same basic testing principles - verify configurations, check for missing security headers and secure coding practices, and ensure proper error handling and logging.