Back to Details

owasp-top-10

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

OWASP Top 10 Security Vulnerabilities

OWASP Top 10安全漏洞

Expert guidance for identifying, preventing, and remediating the most critical web application security risks based on OWASP Top 10 2021.
基于OWASP Top 10 2021的专业指南，用于识别、预防和修复最关键的Web应用安全风险。

When to Use This Skill

何时使用该技能

  • Conducting security audits and code reviews
  • Implementing secure coding practices in new features
  • Reviewing authentication and authorization systems
  • Assessing input validation and sanitization
  • Evaluating third-party dependencies for vulnerabilities
  • Designing security controls and defense-in-depth strategies
  • Preparing for security certifications or compliance audits
  • Investigating security incidents or suspicious behavior
  • 开展安全审计与代码审查
  • 在新功能中实施安全编码实践
  • 审查身份验证与授权系统
  • 评估输入验证与清理机制
  • 检查第三方依赖的安全漏洞
  • 设计安全控制与纵深防御策略
  • 准备安全认证或合规审计
  • 调查安全事件或可疑行为

OWASP Top 10 2021 Overview

OWASP Top 10 2021概述

Ranked by Risk Severity:
  1. A01 - Broken Access Control (↑ from #5)
  2. A02 - Cryptographic Failures (formerly Sensitive Data Exposure)
  3. A03 - Injection (↓ from #1)
  4. A04 - Insecure Design (NEW)
  5. A05 - Security Misconfiguration
  6. A06 - Vulnerable and Outdated Components
  7. A07 - Identification and Authentication Failures
  8. A08 - Software and Data Integrity Failures (NEW)
  9. A09 - Security Logging and Monitoring Failures
  10. A10 - Server-Side Request Forgery (SSRF) (NEW)
按风险严重程度排名：
  1. A01 - 访问控制失效（从第5位上升）
  2. A02 - 加密失败（原敏感数据暴露）
  3. A03 - 注入攻击（从第1位下降）
  4. A04 - 不安全设计（新增）
  5. A05 - 安全配置错误
  6. A06 - 存在漏洞且过时的组件
  7. A07 - 身份识别与认证失败
  8. A08 - 软件与数据完整性失败（新增）
  9. A09 - 安全日志与监控失效
  10. A10 - 服务器端请求伪造（SSRF）（新增）

Quick Reference

快速参考

Load detailed guidance for each vulnerability:
VulnerabilityReference File
Broken Access Control
skills/owasp-top-10/references/broken-access-control.md
Cryptographic Failures
skills/owasp-top-10/references/cryptographic-failures.md
Injection
skills/owasp-top-10/references/injection.md
Insecure Design
skills/owasp-top-10/references/insecure-design.md
Security Misconfiguration
skills/owasp-top-10/references/security-misconfiguration.md
Vulnerable Components
skills/owasp-top-10/references/vulnerable-components.md
Authentication Failures
skills/owasp-top-10/references/authentication-failures.md
Integrity Failures
skills/owasp-top-10/references/integrity-failures.md
Logging & Monitoring
skills/owasp-top-10/references/logging-monitoring.md
SSRF
skills/owasp-top-10/references/ssrf.md
Prevention Strategies
skills/owasp-top-10/references/prevention-strategies.md
加载各漏洞的详细指南：
漏洞类型参考文件
访问控制失效
skills/owasp-top-10/references/broken-access-control.md
加密失败
skills/owasp-top-10/references/cryptographic-failures.md
注入攻击
skills/owasp-top-10/references/injection.md
不安全设计
skills/owasp-top-10/references/insecure-design.md
安全配置错误
skills/owasp-top-10/references/security-misconfiguration.md
存在漏洞的组件
skills/owasp-top-10/references/vulnerable-components.md
认证失败
skills/owasp-top-10/references/authentication-failures.md
完整性失败
skills/owasp-top-10/references/integrity-failures.md
日志与监控
skills/owasp-top-10/references/logging-monitoring.md
SSRF
skills/owasp-top-10/references/ssrf.md
预防策略
skills/owasp-top-10/references/prevention-strategies.md

Security Audit Workflow

安全审计工作流

  1. Identify Scope: Determine application components and attack surface
  2. Select Vulnerabilities: Choose relevant OWASP categories based on features
  3. Load Reference: Read appropriate reference file(s) for detailed patterns
  4. Analyze Code: Review code against vulnerable and secure patterns
  5. Document Findings: Record vulnerabilities with severity and remediation
  6. Verify Fixes: Test that remediations properly address issues
  7. Test Security: Run automated security testing (SAST, DAST, SCA)
  1. 确定范围：明确应用组件与攻击面
  2. 选择漏洞类型：根据功能选择相关的OWASP分类
  3. 加载参考文档：阅读对应的参考文件获取详细模式
  4. 代码分析：对照漏洞模式与安全模式审查代码
  5. 记录发现：记录漏洞及其严重程度与修复方案
  6. 验证修复：测试修复措施是否有效解决问题
  7. 安全测试：运行自动化安全测试（SAST、DAST、SCA）

Core Security Principles

核心安全原则

Defense in Depth

纵深防御

  • Layer security controls at network, application, data, and monitoring levels
  • Ensure failure of one control doesn't compromise entire system
  • 在网络、应用、数据与监控层面分层部署安全控制
  • 确保单一控制失效不会危及整个系统

Secure by Default

默认安全

  • Deny all access by default, explicitly grant permissions
  • Fail securely (errors don't expose sensitive information)
  • Minimize attack surface (disable unused features)
  • Apply least privilege to all accounts and services
  • 默认拒绝所有访问，仅显式授予权限
  • 安全失败（错误信息不会暴露敏感数据）
  • 最小化攻击面（禁用未使用的功能）
  • 对所有账户与服务应用最小权限原则

Input Validation

输入验证

  • Validate type, length, format, and allowed values
  • Use allow-lists over deny-lists
  • Sanitize for specific context (SQL, HTML, shell, etc.)
  • Never trust client input
  • 验证类型、长度、格式与允许值
  • 使用允许列表而非拒绝列表
  • 根据具体场景（SQL、HTML、Shell等）进行清理
  • 绝不信任客户端输入

Common Mistakes

常见错误

  1. Trusting User Input: Always validate and sanitize all user-supplied data
  2. Rolling Your Own Crypto: Use established libraries (bcrypt, AES-256)
  3. Exposing Errors: Log detailed errors internally, show generic messages to users
  4. Missing Authorization: Check permissions on every request, not just UI
  5. Weak Session Management: Use secure, httpOnly, sameSite cookies with HTTPS
  6. Ignoring Dependencies: Regularly audit and update third-party libraries
  7. No Logging: Log security events for detection and incident response
  8. Default Configurations: Harden all systems, disable defaults
  1. 信任用户输入：始终验证并清理所有用户提供的数据
  2. 自行实现加密：使用成熟的库（bcrypt、AES-256）
  3. 暴露错误信息：内部记录详细错误，向用户展示通用信息
  4. 缺失授权检查：对每个请求都检查权限，而非仅在UI层面
  5. 会话管理薄弱：使用安全的、httpOnly、sameSite的Cookie并配合HTTPS
  6. 忽略依赖项：定期审计并更新第三方库
  7. 无日志记录：记录安全事件以用于检测与响应
  8. 默认配置未修改：加固所有系统，禁用默认配置

Security Testing Tools

安全测试工具

SAST (Static): SonarQube, Semgrep, ESLint security plugins DAST (Dynamic): OWASP ZAP, Burp Suite SCA (Dependencies): npm audit, Snyk, Dependabot Secrets Scanning: GitGuardian, TruffleHog Penetration Testing: Metasploit, Kali Linux tools
SAST（静态测试）：SonarQube、Semgrep、ESLint安全插件 DAST（动态测试）：OWASP ZAP、Burp Suite SCA（依赖项分析）：npm audit、Snyk、Dependabot 密钥扫描：GitGuardian、TruffleHog 渗透测试：Metasploit、Kali Linux工具

Resources

资源