myqatools
Tools
Tutorials
Mock API
Home
Security
OWASP Top 10 Checklist
OWASP Top 10 Checklist
Interactive OWASP Top 10 checklist.
0/48 items checked
Reset all
Export MD
A01 — Broken Access Control
Verify principle of least privilege is enforced
Test for IDOR (Insecure Direct Object References)
Check that directory listing is disabled
Verify users cannot access other users' data
Test for privilege escalation (horizontal & vertical)
Check CORS is properly configured
A02 — Cryptographic Failures
Verify sensitive data is not transmitted in cleartext
Check TLS/HTTPS is enforced
Verify strong hashing is used for passwords (bcrypt/argon2)
Check that encryption keys are properly managed
Verify no deprecated cryptographic algorithms (MD5, SHA-1 for passwords)
A03 — Injection
Test for SQL injection in all input fields
Test for NoSQL injection
Test for Command injection
Test for LDAP injection
Verify parameterized queries / ORMs are used
Check user input is validated and sanitized
A04 — Insecure Design
Verify threat modeling was performed
Check for rate limiting on critical endpoints
Verify business logic flows cannot be abused
Check for insecure workflow designs
A05 — Security Misconfiguration
Check default credentials are changed
Verify error messages don't expose stack traces
Check unnecessary features/ports are disabled
Verify security headers are present (CSP, HSTS, X-Frame-Options)
Check cloud storage buckets are not publicly accessible
A06 — Vulnerable and Outdated Components
Check for known CVEs in dependencies
Verify a software bill of materials (SBOM) exists
Check that patch management process is in place
Verify unused dependencies are removed
A07 — Identification and Authentication Failures
Test for brute force protection / account lockout
Verify multi-factor authentication is available
Check session tokens are random and long enough
Verify sessions are invalidated on logout
Test password complexity requirements
Check for credential stuffing protections
A08 — Software and Data Integrity Failures
Verify integrity checks on critical file downloads
Check CI/CD pipeline for unauthorized code changes
Verify deserialization of untrusted data is avoided
Check for auto-update mechanisms that lack verification
A09 — Security Logging and Monitoring Failures
Verify login failures are logged
Check that high-value transactions are audited
Verify logs do not contain sensitive data (passwords, tokens)
Check alerting is configured for anomalous activity
A10 — Server-Side Request Forgery (SSRF)
Test for SSRF in any URL-fetching feature
Verify allow-lists are used for external requests
Check internal services cannot be reached via SSRF
Test cloud metadata endpoints are blocked (169.254.169.254)