Week 7 — Web vulnerabilities (OWASP Top 10)
Learning objectives
- Understand the logic behind each Top 10 category, do not memorize it.
- Use Burp Suite in intercept and repeater mode effectively.
- Write a clean proof of exploitation: request, response, impact.
The 2021 categories in one sentence each
| Category | Central idea |
|---|---|
| A01 – Broken access controls | The application allows what it should forbid. |
| A02 – Cryptographic failures | Sensitive data poorly encrypted or in clear. |
| A03 – Injection | User data executed as code (SQL, LDAP, OS). |
| A04 – Insecure design | Design flaw, not code. |
| A05 – Security misconfiguration | Defaults, verbosity, missing headers. |
| A06 – Vulnerable components | Outdated dependencies. |
| A07 – Identification / auth | Weak sessions, weak passwords, missing MFA. |
| A08 – Software integrity | Compromised supply chain. |
| A09 – Insufficient logging | Nothing is visible. |
| A10 – SSRF | The server is guided toward internal targets. |
Burp Suite in practice
- Configure Firefox to use Burp as a proxy (
127.0.0.1:8080), install the Burp certificate. - Proxy → Intercept: capture an interesting request (form submission, API call).
- Repeater: send and replay the request, varying one parameter at a time.
- Intruder: parametric payloads. One insertion point at a time to stay readable.
Two examples to master
SQL injection — Really verify
Do not settle for a ' OR 1=1 -- that "returns more rows". Confirm with a controlled
extraction:
GET /products?id=42 UNION SELECT null, current_database(), null --
The response must contain a coherent database name. Without this evidence, it is only a hypothesis.
Stored XSS — Concrete impact
A <script>alert(1)</script> proves storage, not impact. The demonstration expected in a
report: a session theft toward a controlled endpoint, or a forced action via
fetch('/api/user/delete', {method:'POST', credentials:'include'}).
Lab 2 kick-off
You pick one vulnerable application from the lab (Juice Shop, DVWA or equivalent). Deliverable for week 9:
- Three Top 10 vulnerabilities exploited, each with request, response, impact.
- A concrete remediation per vulnerability.