Glossary · Security
OWASP Top 10
Also called: OWASP Top Ten, OWASP top 10 list
Definition
OWASP's awareness list of the ten most critical web application security risk categories, widely used to scope security testing and code review.
The OWASP Top 10 is a document from the Open Worldwide Application Security Project that ranks the most critical categories of web application security risk, based on vulnerability data and community input. It is an awareness document, not a complete standard: it tells you where to look first, while a framework such as the OWASP Application Security Verification Standard (ASVS) gives detailed, testable requirements.
The 2021 list
| ID | Category | What a tester checks, for example |
|---|---|---|
| A01 | Broken Access Control | Can user A read or change user B’s data? Can a normal user call admin endpoints? |
| A02 | Cryptographic Failures | Sensitive data sent over plain HTTP, weak password hashing, secrets in responses |
| A03 | Injection | SQL, command and NoSQL injection; cross-site scripting is grouped here |
| A04 | Insecure Design | Missing business-logic limits, such as unlimited coupon reuse |
| A05 | Security Misconfiguration | Default credentials, verbose stack traces, open cloud storage, missing headers |
| A06 | Vulnerable and Outdated Components | Dependencies with known CVEs |
| A07 | Identification and Authentication Failures | Weak session handling, no brute-force protection, broken password reset |
| A08 | Software and Data Integrity Failures | Unsigned updates, insecure deserialisation, untrusted CI/CD inputs |
| A09 | Security Logging and Monitoring Failures | Failed logins and access denials not logged or alerted |
| A10 | Server-Side Request Forgery (SSRF) | A URL parameter that makes the server fetch internal addresses |
OWASP updates the list every few years. Check owasp.org for the current edition before quoting category numbers in a report, because rankings and groupings change between versions.
How testers use it
- Scoping. Map each category to concrete checks for your application, then decide which to automate, which to cover manually and which belong to a specialist penetration test.
- Automation where it fits. Access-control checks (two users, swap IDs, expect
403or404) and dependency scanning run well in CI. Dynamic scanners such as OWASP ZAP can run against staging.
Common mistakes
Treating the list as a checklist that, once ticked, means “secure”, and confusing it with OWASP’s separate Top 10 lists for APIs and LLM applications, which have their own categories.
Only test systems you own or have written authorisation to test.