SSRF flaws occur when a web app fetches a remote resource without validating the user-supplied URL. Attackers can coerce the app to send a request to an unexpected destination—even if it’s secured by a firewall, VPN, or other network access control list (ACL). A secure design can still have implementation defects leading to vulnerabilities.

  • Just to show how user can submit data in application input field and check response.
  • We will then examine Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery (SSRF).
  • The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software.
  • We will then examine Broken Access Control, Cryptographic Failures, Injection Attacks, Insecure Design and Security Misconfiguration.

The Secure Coding Practices Quick-reference Guide checklists have also been migrated to the Developer Guide;this provides a wider audience for the original checklist. As software becomes more OWASP Lessons configurable, there is more that needs to be done to ensure it is configured properly and securely. This is a broad topic that can lead to sensitive data exposure or system compromise.

Related Projects

The following agenda is based on a full day workshop including lecture. The Secure Coding Dojo is a training platform which can be customized to integrate with custom vulnerable websites and other CTF challenges. The project was initially developed at Trend Micro and was donated to OWASP in 2021. Security Journey’s OWASP dojo will be open and available to all OWASP members starting April1st.

The OWASP Secure Coding Practices Quick-reference Guide project has now been archived. We need to always confirm the users’ identity, authentication, and session management. Insecure design represents different weaknesses, expressed as “missing or ineffective. This is a large topic that includes SQL injection, XSS, prototype pollution and more. If you are using the .NET Framework, you can find some code snippets here. You will need to attach the anti-forgery token to AJAX requests.

Lessons learned

If fin aid or scholarship is available for your learning program selection, you’ll find a link to apply on the description page. We help IT and security professionals advance their careers with skills development and certifications while empowering all employees with security awareness and privacy training to stay cyber-safe at work and home. In this course, we will examine three very relevant security risks that were merged into larger topics in the OWASP Top Ten 2021 list. It’s still important to know the details of how these risks work. We will explore XML External Entities (XXE), Cross-Site Scripting (XSS) and Insecure Deserialization. We will then examine Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery (SSRF).