OWASP Top 10 — 2021

1. IDOR (Insecure Direct Object Reference)
   └─ User changes URL from /api/users/123 to /api/users/456
   └─ Sees another user's personal data
   └─ No authorisation check on the backend

2. Privilege Escalation
   └─ Normal user sends POST /admin/deleteUser
   └─ Server doesn't verify admin role
   └─ Regular user deletes admin accounts

3. Missing Access Control on APIs
   └─ Mobile app calls GET /api/orders
   └─ Backend returns all orders (not just user's)
   └─ No filtering by authenticated user ID

# BROKEN — No access control check
@app.route('/api/users/<int:user_id>')
def get_user(user_id):
    user = db.query(f"SELECT * FROM users WHERE id = {user_id}")
    return jsonify(user)

# FIXED — Verify the requesting user owns the resource
@app.route('/api/users/<int:user_id>')
def get_user(user_id):
    current_user_id = get_current_user_id()
    if current_user_id != user_id and not is_admin():
        return jsonify({"error": "Forbidden"}), 403
    user = db.query("SELECT * FROM users WHERE id = ?", (user_id,))
    return jsonify(user)

Minimum Crypto Standards:
  └─ Passwords: bcrypt (cost 10+), Argon2, PBKDF2
  └─ TLS: v1.2 minimum, v1.3 preferred
  └─ Symmetric: AES-256-GCM (not CBC)
  └─ Asymmetric: RSA-2048+ or ECDSA P-256
  └─ Hashing: SHA-256 minimum (not MD5, not SHA-1)
  └─ Key storage: HSM or key management service (AWS KMS, Azure Key Vault)
  └─ Perfect Forward Secrecy: Required for TLS

-- VULNERABLE: String concatenation
query = "SELECT * FROM users WHERE email = '" + email + "' AND password = '" + password + "'"

-- Input: email = "admin@test.com' -- "
-- Result: SELECT * FROM users WHERE email = 'admin@test.com' -- ' AND password = 'anything'
-- The -- comments out the password check. Logged in as admin!

-- Input: email = "' OR 1=1 -- "
-- Result: SELECT * FROM users WHERE email = '' OR 1=1 -- '
-- Returns all users. Logged in as the first user.

# FIXED: Parameterised query (SQL injection impossible)
cursor.execute(
    "SELECT * FROM users WHERE email = ? AND password = ?",
    (email, password)
)

Cloud Misconfigurations:
  └─ AWS S3 bucket set to public (most common cloud breach cause)
  └─ Default security group allows all traffic (0.0.0.0/0)
  └─ Database publicly accessible from internet

Web Server Misconfigurations:
  └─ Directory listing enabled (attacker sees file structure)
  └─ Default admin credentials (admin:admin)
  └─ Error pages revealing stack traces
  └─ Sample applications left deployed (/admin, /test)

Framework Misconfigurations:
  └─ Debug mode enabled in production (Django DEBUG=True)
  └─ CORS set to Access-Control-Allow-Origin: *
  └─ HSTS not enabled

The Log4Shell vulnerability (CVE-2021-44228, December 2021):
  └─ CVSS 10.0 (maximum severity)
  └─ Remote code execution in Apache Log4j logging library
  └─ Affected millions of applications (every Java app using Log4j)
  └─ Exploitation began within hours of disclosure
  └─ Some organisations still unpatched 6+ months later

Why it keeps happening:
  └─ Developers don't track dependency versions
  └─ No automated vulnerability scanning in CI/CD
  └─ Transitive dependencies (library includes vulnerable sub-library)
  └─ "It works, don't touch it" mentality

  └─ Attackers compromised the SolarWinds build pipeline
  └─ Signed malicious code with SolarWinds certificate
  └─ 18,000 customers installed the backdoored update
  └─ Including US federal government agencies
  └─ Undetected for 9+ months

  Prevention:
  └─ Signed code: Verify digital signatures of all dependencies
  └─ SBOM: Software Bill of Materials for every application
  └─ Reproducible builds: Build from source, not precompiled binaries
  └─ CI/CD security: Protect build pipeline, limit who can push

Must Log:
  └─ All authentication attempts (success + failure)
  └─ Privileged operations (admin actions, role changes)
  └─ Data access to sensitive records
  └─ Configuration changes
  └─ Error conditions (especially 403, 500 errors)
  └─ Input validation failures

Must NOT Log:
  └─ Passwords (even hashed during transmission)
  └─ Credit card numbers (PCI violation)
  └─ PII without business justification (GDPR violation)
  └─ Session tokens (privilege escalation risk)

# VULNERABLE: Application fetches a URL provided by the user
url = request.args.get('url')
response = requests.get(url)  # User can pass file:///etc/passwd or http://169.254.169.254/ (AWS metadata)

# Exploitation:
# SSRF to AWS metadata endpoint:
# GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/admin
# Returns AWS access keys allowing full cloud account access

# SSRF to internal service:
# GET /fetch?url=http://internal-admin-panel/deleteUser?id=admin
# Exploits internal service that has no authentication

  └─ Attacker exploited SSRF in a WAF misconfiguration
  └─ Accessed AWS metadata service from a web server
  └─ Stole IAM role credentials for the server
  └─ Used those credentials to exfiltrate S3 data
  └─ 106 million customer records compromised
  └─ $190M in fines and settlements