# OWASP Top 10 — checks and exploit scenarios

Phase 1 of the security audit: systematically check the code against each OWASP Top 10 category. Each category lists what to check for and at least one realistic exploit scenario.

**Core rule:** If you cannot describe how an attacker would exploit a finding, it is not a real finding. Every finding at MEDIUM or above MUST include a realistic exploit scenario.

---

## A01: Broken Access Control

**Check for:**
- Missing authorization checks on endpoints
- Privilege escalation paths (user accessing admin resources)
- Insecure direct object references (IDOR) -- can user A access user B's data by changing an ID?
- Missing function-level access control
- CORS misconfiguration allowing unauthorized origins
- Directory traversal in file operations

**Exploit scenario example:**

```
FINDING: IDOR in GET /api/users/:id
EXPLOIT: Authenticated user changes :id parameter to another user's ID.
  curl -H "Authorization: Bearer <user-a-token>" /api/users/<user-b-id>
  Response: 200 OK with user B's profile data including email, phone, address.
IMPACT: Any authenticated user can read any other user's personal data.
SEVERITY: HIGH
FIX: Verify requesting user's ID matches :id parameter, or user has admin role.
```

## A02: Cryptographic Failures

**Check for:**
- Passwords stored in plaintext or weak hash (MD5, SHA1)
- Sensitive data transmitted without TLS
- Hardcoded encryption keys or IVs
- Weak random number generation for tokens/sessions
- PII stored without encryption at rest
- Deprecated cryptographic algorithms

**Exploit scenario example:**

```
FINDING: Password hashed with MD5 in user registration
EXPLOIT: Attacker obtains database dump. MD5 hashes cracked in seconds using
  rainbow tables. All user passwords compromised.
IMPACT: Full account takeover for all users.
SEVERITY: CRITICAL
FIX: Use bcrypt/scrypt/argon2id with appropriate cost factor.
```

## A03: Injection

**Check for:**
- SQL injection (string concatenation in queries)
- NoSQL injection (unsanitized input in MongoDB queries)
- Command injection (user input in exec/spawn/system calls)
- LDAP injection
- Template injection (user input rendered in server-side templates)
- Header injection (user input in HTTP headers)

**Exploit scenario example:**

```
FINDING: SQL injection in search endpoint
CODE: db.query(`SELECT * FROM products WHERE name LIKE '%${req.query.search}%'`)
EXPLOIT: Attacker sends: /search?search=' UNION SELECT username,password FROM users--
  Returns all usernames and password hashes.
IMPACT: Full database read access including credentials.
SEVERITY: CRITICAL
FIX: Use parameterized query: db.query('SELECT * FROM products WHERE name LIKE $1', [`%${search}%`])
```

## A04: Insecure Design

**Check for:**
- Missing rate limiting on authentication endpoints
- No account lockout after failed attempts
- Business logic flaws (negative quantities, race conditions in payments)
- Missing input validation on business rules
- Lack of defense in depth

**Exploit scenario example:**

```
FINDING: No rate limiting on POST /api/auth/login
EXPLOIT: Attacker runs brute-force attack with common password list.
  At 100 requests/second, 10000 common passwords tested in 100 seconds.
  No lockout, no CAPTCHA, no delay.
IMPACT: Account takeover for users with weak passwords.
SEVERITY: HIGH
FIX: Add rate limiting (5 attempts per minute per IP), account lockout after 10 failures,
  progressive delays, CAPTCHA after 3 failures.
```

## A05: Security Misconfiguration

**Check for:**
- Debug mode enabled in production
- Default credentials in configuration
- Unnecessary features enabled (directory listing, stack traces)
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Overly permissive CORS
- Verbose error messages exposing internal details

## A06: Vulnerable and Outdated Components

**Check for:**
- Known CVEs in dependencies (npm audit, pip audit, cargo audit)
- Outdated packages with known vulnerabilities
- Abandoned/unmaintained packages
- Packages with very few maintainers (bus factor risk)

**Run dependency audit:**

```bash
# Node.js
npm audit
# or: npx better-npm-audit audit

# Python
pip audit
# or: safety check

# Go
govulncheck ./...

# Rust
cargo audit
```

## A07: Identification and Authentication Failures

**Check for:**
- Weak password requirements
- Session tokens in URLs
- Session fixation vulnerabilities
- Missing session invalidation on logout/password change
- JWT without expiration
- JWT secret hardcoded or weak

## A08: Software and Data Integrity Failures

**Check for:**
- Unsigned updates or deployments
- Untrusted CI/CD pipeline modifications
- Deserialization of untrusted data
- Missing integrity checks on critical data

## A09: Security Logging and Monitoring Failures

**Check for:**
- Missing audit logs for authentication events
- Missing logs for authorization failures
- No alerting on suspicious patterns
- Sensitive data in log output (passwords, tokens, PII)
- Log injection vulnerabilities

## A10: Server-Side Request Forgery (SSRF)

**Check for:**
- User-controlled URLs in server-side requests
- Missing URL allowlist validation
- Internal network access via crafted URLs
- Cloud metadata endpoint access (169.254.169.254)

**Exploit scenario example:**

```
FINDING: SSRF in image proxy endpoint
CODE: const image = await fetch(req.query.url);
EXPLOIT: Attacker sends: /proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/
  Server fetches AWS credentials and returns them to attacker.
IMPACT: Full AWS account access via stolen IAM credentials.
SEVERITY: CRITICAL
FIX: Validate URL against allowlist. Block private IP ranges. Block metadata endpoints.
  Use a URL parsing library, do not rely on string matching.
```