Why This Matters#

Web applications are the most common attack surface. They’re internet-facing, complex, and handle sensitive data. Most breaches involve exploiting web application vulnerabilities.

OWASP Top 10 (2021)#

The Open Web Application Security Project’s definitive list of critical web risks:

Injection Attacks#

SQL Injection#

The server treats user input as SQL code:

Login form: username = admin' --
Query: SELECT * FROM users WHERE username='admin' --' AND password='anything'
Result: Password check bypassed (commented out)

Types:

Prevention:

Command Injection#

User input executed as OS command:

Input: filename = "; rm -rf /"
Command: convert "; rm -rf /" output.png

Prevention: Never pass user input to shell commands. Use language APIs instead of exec()/system().

LDAP, NoSQL, Template Injection#

Same principle — untrusted data reaches an interpreter:

Cross-Site Scripting (XSS)#

Attacker injects JavaScript that executes in victim’s browser:

Types#

Impact#

• Steal session cookies → account takeover
• Redirect to phishing page
• Keylog user input
• Modify page content (defacement, fake forms)
• Cryptocurrency mining

Prevention#

Content Security Policy (CSP)#

Content-Security-Policy: 
  default-src 'self';
  script-src 'self' https://cdn.example.com;
  style-src 'self' 'unsafe-inline';
  img-src *;
  connect-src 'self' https://api.example.com;

Cross-Site Request Forgery (CSRF)#

Tricks an authenticated user’s browser into making unintended requests:

sequenceDiagram
    participant V as Victim (logged into bank)
    participant E as Evil Site
    participant B as Bank
    
    V->>E: Visits evil.com
    E->>V: Page with hidden form
    Note over V: Browser auto-submits form
    V->>B: POST /transfer?to=attacker&amount=10000
    Note over B: Valid session cookie attached
    B->>B: Transfer executed

Prevention#

Server-Side Request Forgery (SSRF)#

Attacker makes the server fetch resources from unintended locations:

flowchart LR
    Attacker["Attacker"] -->|"url=http://169.254.169.254/..."| Server["Your Server"]
    Server -->|"Fetches"| Meta["Cloud Metadata<br/>(credentials!)"]
    Meta -->|"Returns IAM creds"| Server
    Server -->|"Returns to"| Attacker

Common Targets#

Prevention#

Broken Access Control#

The #1 OWASP risk. Users accessing resources or actions they shouldn’t:

Common Patterns#

Prevention#

Security Headers#

HTTP headers that instruct browsers to enable security features:

API Security#

APIs have unique attack vectors beyond traditional web apps:

Key Takeaways#

1. Input is untrusted — validate, sanitize, and encode ALL user input
2. Parameterized queries eliminate SQL injection entirely — no exceptions
3. CSP is essential — it’s the strongest defense against XSS
4. Authorization on every request — never trust client-side checks alone
5. SSRF is cloud-critical — block metadata access, use IMDSv2
6. Security headers are free — enable them all, they cost nothing
7. APIs need the same rigor as web UIs — often they get less scrutiny