はてなブックマーク

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept The OWASP Top 10 for Large Language Model Applications project aims to educate developers, designers, architects, managers, and organizations about the potential security risks when deploying and managing Large Language Models (LLMs). The project provides a list of the top 10 most c

APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user. Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementa

導入 OWASP Top 10 - 2021 へようこそ OWASP トップ 10 の最新版へようこそ! OWASP トップ 10 2021年版は、グラフィックデザインが一新され、1ページのインフォグラフィックになっています。インフォグラフィックは、ホームページから入手でき、印刷することができます。 今回のトップ10の作成にあたって、貴重な時間やデータを提供してくださったすべての皆さんに感謝します。皆様のご協力なくしては、OWASP トップ 10 2021年版は存在し得ません。本当に、感謝いたします。 2021年版トップ10の変更点 2021年版トップ10では、3つの新しいカテゴリー、4つのカテゴリーの名称とスコープの変更がありました。統合されたものもいくつかあります。 A01:2021-アクセス制御の不備 は、5位から最も深刻なWebアプリケーションのセキュリティリスクへと順位を上げまし

Introduction Welcome to the OWASP Top 10 - 2021 Welcome to the latest installment of the OWASP Top 10! The OWASP Top 10 2021 is all-new, with a new graphic design and an available one-page infographic you can print or obtain from our home page. A huge thank you to everyone that contributed their time and data for this iteration. Without you, this installment would not happen. THANK YOU! What's cha

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Introduction 🎯 The OWASP Secure Headers Project (also called OSHP) describes HTTP response headers that your application can use to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vul

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Description Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration. This c

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other sec

Author: Ryan Dewhurst Contributor(s): KirstenS, Nick Bloor, Sarah Baso, James Bowie, Ram ch, EvgeniyRyzhkov, Iberiam, Ann.campbell, Ejohn20, Jonathan Marcil, Christina Schelin, Jie Wang, Fabian, Achim, Dirk Wetter, kingthorin Description Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as white-box testing) and is carried out at th

Author: Weilin Zhong, Achim Contributor(s): Delink, Christopher Hendrix, Wichers, Jmanico, Thomas Herzog, Duccio Fabbri, EPaul, kingthorin Note: These Regexs are examples and not built for a particular Regex engine. However, the PCRE syntax is mainly used. In particular, this means that character classes do not contain meta characters which need to be escaped, except the - and ] character, where i

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept What is API Security? A foundational element of innovation in today’s app-driven world is the API. From banks, retail and transportation to IoT, autonomous vehicles and smart cities, APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-fa

Thank you for visiting OWASP.org. We have migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. SQLi A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or LibreOffice Calc is used to open a CSV, any cells starting with = will be interpreted by the software as a formula. Maliciously crafted formulas can be used for three key attacks: Hijacking the user’s computer by exploiting vulnerabiliti

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept The OWASP Internet of Things Project is designed to help manufacturers, developers, and consumers better understand the security issues associated with the Internet of Things, and to enable users in any context to make better security decisions when building, deploying, or assessing

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Mobile Top 10 2024: Final Release Updates The new Mobile Top 10 list for 2024 is out now. We would love to see you participate and contribute to the research we are doing. Join the SLACK Channel If you face any issues joining us on Slack, please feel free to reach out to Project Lea

other downloads Project Pamphlet Project Presentation Slide deck- Presented by Keith Turpin on OWASP AppSec USA 2010 Archive XLS Feedback Spreadsheet If you contribute to this Project, please add your name here. Project Leaders Keith Turpin Jon Gadsden Contributors Andrew Petukhov Anurag Agarwal Brad Causey Caleb McGary Catherine Spencer Dan Kranz Jason Coleman Jim Manico Ludovic Petit Michael V.

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept What is this? The OWASP HTML Sanitizer Projects provides Java based HTML sanitization of untrusted HTML! About The OWASP HTML Sanitizer is a fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while

Thank you for visiting OWASP.org. We have migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. Background This article describes the many different types or categories of cross-site scripting (XSS) vulnerabilities and how they relate to each other. Early on, two pr

This is an example of a Project or Chapter Page. Please change these items to indicate the actual information you wish to present. In addition to this information, the ‘front-matter’ above this text should be modified to reflect your actual information. An explanation of each of the front-matter items is below: layout: This is the layout used by project and chapter pages. You should leave this val

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Dependency-Check is a Software Composition Analysis (SCA) tool that attempts to detect publicly disclosed vulnerabilities contained within a project’s dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If foun

Thank you for visiting OWASP.org. We have migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. NVD Categorization CWE-611: Improper Restriction of XML External Entity Reference: The software processes an XML document that can contain XML entities with URIs that res

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept What is This? The OWASP Top Ten Proactive Controls describes the most important controls and control categories that every architect and developer should absolutely, 100% include in every project. OWASP Top 10 Proactive Controls 2018 Software developers are the foundation of any app

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept AppSensor The AppSensor project defines a conceptual framework and methodology that offers prescriptive guidance to implement application layer intrusion detection and automated response. In addition, there is a reference implementation that provides a toolkit for building self-defe

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Background Certificate and Public Key Pinning is a guide to understanding the current state of PKI security and significant changes in the threat model for TLS connections. Pinning was discussed at the Virginia chapter’s presentation Securing Wireless Channels in the Mobile Space. T

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Introduction The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can th

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept Our Goal The OWASP Cheat Sheet Series was created to provide a set of simple good practice guides for application developers and defenders to follow. Rather than focused on detailed best practices that are impractical for many developers and applications, they are intended to provid

Thank you for visiting OWASP.org. We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. The historical content can be found here. Please visit our Page Migration Guide for more information about updating pages for the new website as well as examples of g

This website uses cookies to analyze our traffic and only share that information with our analytics partners. Accept OWASP Japanチャプターのホームページへようこそ。 OWASP - Open Worldwide Application Security Project とは、Webをはじめとするソフトウェアのセキュリティ環境の現状、またセキュアなソフトウェア開発を促進する技術・プロセスに関する情報共有と普及啓発を目的としたプロフェッショナルの集まる、オープンソース・ソフトウェアコミュニティです。The OWASP Foundationは、NPO団体として全世界のOWASPの活動を支えています。 OWASP Japanチャプターは、首都圏のみならず、国内全域における

Author: KirstenS Contributor(s): Dave Wichers, Davisnw, Paul Petefish, Adar Weidman, Michael Brooks, Ahsan Mir, Dc, D0ubl3 h3lix, Jim Manico, Robert Gilbert, Tgondrom, Pawel Krawczyk, Brandt, A V Minhaz, Kevin Lorenzo, Andrew Smith, Christina Schelin, Ari Elias-Bachrach, Sarciszewski, kingthorin, Ben Spatafora, Krishna Madala Overview Cross-Site Request Forgery (CSRF) is an attack that forces an e