Now, just like when we were starting to learn about vulnerabilities and trying
to find a way for us to be able to scan for them,
so is the world of web servers and web applications.
And there is a repository for us to be able to examine such things and have a
reference for us to be able to go back to.
Now, this repository does not help us in the actual scanning of vulnerabilities
.
What it does is it gives us awareness into the actual problems that exist, that
you either the organization or individual users report, and that is OWASP.
And that is the Open Worldwide Application Security Project.
And I'm going to take a look at it here on the science screen for us real quick
.
Very straightforward site, and we'll go through this just a little bit, because
this is actually going to be something that we reference for the next few
skills.
In terms of understanding the vulnerabilities that we find and potentially help
us look for more against certain web applications and servers.
And this allows us to have an easy and readily available repository of
vulnerabilities, specifically against things that have already been noticed,
either through things like NSSIS or other scanning tools out there.
But we're sticking within that web application and server realm.
It's free, and that's one of the most important things right there, that it is
free, but it's also vendor neutral.
And think of this as like a POSIX-based thing to where Unix doesn't require any
specified hardware or software, so does OWASP.
One of the best things about it is that it's one and most well known with OWASP
is the actual top 10.
Now I'm going to click X on the donate now, and on the top you'll see where we
have projects, and you can go into the actual top 10.
Now I will zoom in for us and show us what else that they have available to us,
because you can see application security verification standards,
gen AI security projects, mobile application security, all sorts of different
stuff.
But the top 10 is what we're going to be focusing on, because those go
primarily for the web applications and servers.
And when you click on there, you scroll down just a little bit, and you can see
here that we do have top 10 web applications, see the security risk.
Now, you can see that there's a lot of cross between what was found in 2017 and
2021.
And this is just to give you an idea that some things never go away.
In terms of configuration, vulnerabilities, and even like code.
So some errors are going to come back and bite you in the foot if they are
ignored.
And this is a prime example of that.
As you start to go down, you'll see that there you can actually click on some
of these top 10 different things like broke alpha 01, 2021 broken access
control.
Now, this is from 2021, but it's still persist.
And you can even go into it and see where they tie into for the different
applications.
We'll do that here in just a second.
But you can see it moves up from the fifth position, 94% of applications that
were tested from some form of broke, have some form of broken access control.
And these 30, the 34 common weakness enumerations mapped to broken access
control had more occurrences in applications than any other category.
So broken access control can be tied to security configurations.
And that's not necessarily a vulnerability in the software.
When we're doing our recon and research for pen testing, it's just that it
could be somebody typed in a poor password and that was cracked or that a user
account was mapped to an incorrect role or function.
And they had more permissions or fewer permissions than what they needed or
were allowed.
So if you go in there and actually click on that particular definition, you can
see in here where it kind of reads like a CV, which we should be familiar with.
And it gives you the description of it and also most importantly, how to
prevent that.
There we go up there.
And you can even see scrolling down example attack scenarios. Now, these are
done in different variations. You can see that the first one is the application
was unveiled.
What uses unverified data in a SQL call, meaning that that's going to start
getting into like SQL injection attacks and other SQL vulnerabilities that we
will begin to cover here pretty soon.
And further, an attacker simply modifies the web browser's account parameter to
send whatever account number they want.
And that's done even if you notice inside of HTTPS.
So this is a configuration error on this particular part right here because
some web servers should mask what they're sending inside the web address bar
that the user actually sees when they click on a button or send a request.
So this is going to be a very important part of the course to the actual server
.
And it's good to be able to familiarize ourselves with the OOS top 10 because
as we continue throughout the course, you'll see that a lot of what we're
dealing with and practicing on in terms of pin testing can be linked back to
this end or the CVEs that we've learned about earlier in this course.
Keep in links below for you to be able to go through and examine some of this
for yourself. Now, we will reference a loss from time to time as we continue to
make sure that we're keeping up to date with the actual vulnerability and pin
testing exploit that we're using against certain things that we find and trying
to do throughout this course.
Because this is one of the heavy references that we'll need to keep an eye on
just like with the CVEs.
And as a pen tester, it's always good to be able to go back and rereference
things like this because you may learn about something that you weren't using
before that may make life a whole lot easier when you're testing against
certain things.
And like we said previously in the skill, we aren't all masters of every single
thing in cybersecurity.
Using resources like OOSP and their top 10 lets us be able to learn more about
how to apply the skills that we do know just in a new and different way.