Position: penetration tester
Category: Security
English level: upper
Years of experience: 1


I work on a project:

OWASP TOP 10 Broken Access Control

Broken Access Control happen when a user can access a resource or 
take an action they are not allowed to; this is a weakness in the
system's access control.
Common access control vulnerabilities include:
1.violatiov of the principle of least privilege
2.modifying the URL, permitting viewing or editing someone else's account

How to prevent
1.Disable web server directory listing
2.implement deny access default function
3.Continuous assessment of application with invalid input

OWASP TOP 10 Injection Flaw

It is a type of attack where attacker supplies untrusted input to a program, 
This input gets processed by an interpreter as part of a command or query.
. The different type of injection attack:
. Command injection
.SQL injection
. Code injection

How to prevent
1.input validation
2.Use positive server-side input validation
3.escape special characters using the specific escape

OWASP TOP 10 Insecure Design

Insecure design comprises a variety of risks that arise from neglecting design and 
architectural best practices, beginning with the planning phase and 
continuing through the implementation phase.
.An insecure design cannot be fixed by a perfect implementation 
. Preventive Action
. Use threat modeling for critical authentication, access control, 
business logic, and key flows
. Limit resource consumption by user or service

OWASP TOP 10 Security Misconfiguration

1.Security misconfiguration can happen at any level of an application stack, 
including the network services, platform etc.
2.Application might be vulnerable if the application is:
. missing appropriate security hardening
. Unnecessary features are enabled or installed 
. Default accounts and their passwords are still enabled and unchanged.

3.How to prevent
. A repeatable hardening process
. minimal platform without any unnecessary features
. Segmented application architecture

And also, on my team; my current role in the Team is Red Team and I was going against the Blue Team.

what you want to improve
what I really want to improve is security, efficiency, and good application.