OWASP Top 10 awareness in Testing Fundamentals - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the OWASP Top 10 risk related to broken authentication.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for broken authentication

Drag options to blanks, or click blank then click option'

AA5-Security Misconfiguration

BA1-Injection

CA3-Sensitive Data Exposure

DA2-Broken Authentication

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing injection with authentication issues.

Choosing risks unrelated to user login.

The OWASP Top 10 risk related to broken authentication is A2-Broken Authentication.

2fill in blank

medium

Complete the code to select the OWASP Top 10 risk that involves attackers injecting malicious code.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for code injection attacks

Drag options to blanks, or click blank then click option'

AA1-Injection

BA4-Insecure Design

CA7-Identification and Authentication Failures

DA9-Using Components with Known Vulnerabilities

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing injection with design flaws.

Choosing risks related to authentication instead.

The OWASP Top 10 risk for code injection attacks is A1-Injection.

3fill in blank

hard

Fix the error in the code to correctly assign the OWASP Top 10 risk for sensitive data exposure.

Testing Fundamentals

risk = "[1]"  # OWASP Top 10 risk for sensitive data exposure

Drag options to blanks, or click blank then click option'

AA3-Sensitive Data Exposure

BA8-Insecure Deserialization

CA6-Vulnerable and Outdated Components

DA10-Insufficient Logging & Monitoring

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing outdated components risk instead.

Confusing with insecure deserialization.

The correct OWASP Top 10 risk for sensitive data exposure is A3-Sensitive Data Exposure.

4fill in blank

hard

Fill both blanks to complete the code that creates a dictionary mapping OWASP risk codes to their descriptions.

Testing Fundamentals

owasp_risks = {"[1]": "Injection", "[2]": "Broken Authentication"}

Drag options to blanks, or click blank then click option'

AA1-Injection

BA2-Broken Authentication

CA3-Sensitive Data Exposure

DA4-Insecure Design

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping the codes for Injection and Broken Authentication.

Using risk codes unrelated to the descriptions.

The dictionary keys for Injection and Broken Authentication are A1-Injection and A2-Broken Authentication respectively.

5fill in blank

hard

Fill all three blanks to complete the code that filters OWASP risks starting with 'A' and having a number less than 5.

Testing Fundamentals

filtered_risks = {risk: desc for risk, desc in risks.items() if risk[1] [2] and int(risk[1]) [3] 5}

Drag options to blanks, or click blank then click option'

A.startswith('A')

B<

C<=

D==

Attempts:

3 left

💡 Hint

Common Mistakes

Using '<=' instead of '==' for exact match.

Using '==' instead of '<' for numeric comparison.

The code checks if the risk starts with 'A' (using .startswith('A')), then verifies the second character equals '1' (using ==), and finally checks if the integer value of the second character is less than 5 (using <).

Note: The second blank is best as '==' to check exact match, and the third blank is '<' to check less than 5.