Dave can input malicious field names or data because it is not being checked within the context of the current user and process Jee can bypass the centralized encoding routines since they are not being used everywhere, or the wrong encodings are being used Jason can bypass the centralized validation routines since they are not being used on all inputs Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected and/or sanitized can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity during data validation such as can pretend to be Colin) Dennis has control over input validation, output validation or output encoding code or routines so they can be bypassed Q & K
Geoff can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card) Authentication A Authentication Authentication 2 Authentication 3 You have invented a new attack against Authentication (no card) James can undertake authentication functions without the real user ever being aware this has occurred (e.g. attempt to log in, log in with stolen credentials, reset the password) Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password Read more about this topic in OWASP’s free Authentication Sheet 4 5 6 7
Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords Authentication 8 Authentication 9 Authentication 10 Authentication J Kate can bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because there is no authentication requirement, or it was mistakenly assumed authentication would be undertaken by some other system or performed in some previous action Q K
Christopher can inject a command that the application will run at a higher privilege level Ryan can influence or alter authorization controls and permissions, and can therefore bypass them (no card) (no card) Cryptography A Cryptography Cryptography 2 Cryptography 3 You have invented a new attack against Cryptography (no card) Kyun can access data because it has been obfuscated rather than using an approved cryptographic function Axel can modify transient or permanent data (stored or in transit), or source code, or updates/patches, or configuration data, because it is not subject to integrity checking Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection 4 5 6 7
1.10 04 Mar 2015 Change log date corrected for v1.05. Cross-references updated for 2014 version of ASVS. Contributors updated. Minor text changes to cards to improve readability. Project contributors All OWASP projects rely on the voluntary efforts of people in the software development and information security sectors. They have contributed their time and energy to make suggestions, provide feedback, write, review and edit documentation, give encouragement, the game, and promote the concept. Without all their efforts, the project would not have progressed to this point. OWASP’s hard-working employees