OWASP Top 10 awareness in Testing Fundamentals - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the OWASP Top 10?

The OWASP Top 10 is a list of the ten most critical web application security risks, created to raise awareness and help developers and testers protect applications.

beginner

Name one common risk listed in the OWASP Top 10.

Injection flaws, such as SQL injection, are a common risk where attackers send malicious data to trick the application into executing unintended commands.

intermediate

Why is 'Broken Authentication' a serious risk in OWASP Top 10?

Broken Authentication means attackers can take over user accounts or sessions because the application does not properly protect login or session management.

beginner

How can testers help reduce risks from the OWASP Top 10?

Testers can check for vulnerabilities by trying to exploit common risks like injection or broken authentication and report issues so developers can fix them.

beginner

What does 'Sensitive Data Exposure' mean in the OWASP Top 10?

It means that important data like passwords or credit card numbers are not properly protected and can be stolen or seen by attackers.

Which of the following is NOT part of the OWASP Top 10 risks?

A Slow Internet Connection

B Broken Authentication

C Injection

D Cross-Site Scripting (XSS)

Slow Internet Connection is not a security risk listed in the OWASP Top 10. The others are common security risks.

What does 'Injection' risk mean in OWASP Top 10?

A Injecting viruses into the computer hardware

B Injecting ads into the website

C Sending malicious data to trick the application into running harmful commands

D Injecting code into the browser's memory

Injection means attackers send harmful data to the application to make it run commands it should not.

Why is 'Broken Authentication' dangerous?

A It causes the website to load slowly

B It allows attackers to take over user accounts

C It breaks the website layout

D It disables the login button

Broken Authentication lets attackers access user accounts by bypassing login protections.

Which OWASP Top 10 risk involves attackers stealing sensitive information like passwords?

A Sensitive Data Exposure

B Security Misconfiguration

C Cross-Site Request Forgery

D Using Components with Known Vulnerabilities

Sensitive Data Exposure means important data is not properly protected and can be stolen.

How can testers help improve security based on OWASP Top 10?

A By ignoring security and focusing only on UI

B By deleting user accounts

C By making the website faster

D By trying to find and report security weaknesses

Testers help by finding security problems and telling developers to fix them.

Explain the importance of the OWASP Top 10 for software testers.

Think about how knowing common risks helps testers find problems.

Describe how 'Injection' and 'Broken Authentication' risks can affect a web application.

Focus on what attackers can do with these vulnerabilities.