Back to Details

web-security-review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Web Security Review (OWASP Top 10)

Web安全审查（OWASP Top 10）

Review web applications against all 10 OWASP Top 10 risks by following the full procedure in 
plays/owasp-top10-web-review.md
.
遵循
plays/owasp-top10-web-review.md
中的完整流程，针对全部10项OWASP Top 10风险对Web应用进行审查。

Steps

步骤

  1. Application Mapping — Identify framework/language, deployment model (monolith/microservices), trust boundaries (internet/internal/local), data sensitivity (PII, financial, health), and authentication mechanisms.
  2. Assess Each OWASP Top 10 Risk:
    • A01 Broken Access Control — Missing authz checks, IDOR, privilege escalation, path traversal, CORS misconfigurations
    • A02 Cryptographic Failures — Weak algorithms, missing TLS, hardcoded keys, improper key management, cleartext storage
    • A03 Injection — SQLi, NoSQLi, OS command injection, LDAP injection, XSS, SSTI, XPath injection
    • A04 Insecure Design — Missing security requirements, business logic flaws, insecure workflows, threat modeling gaps
    • A05 Security Misconfiguration — Default configs, verbose errors, missing headers, unnecessary features, outdated components
    • A06 Vulnerable Components — Unpatched libraries, unsupported dependencies, lack of inventory, missing SBOM
    • A07 Identification & Auth Failures — Weak passwords, session issues, MFA gaps, credential stuffing, brute force
    • A08 Software & Data Integrity Failures — Insecure deserialization, unsigned updates, CI/CD attacks, dependency confusion
    • A09 Security Logging & Monitoring Failures — Missing audit logs, insufficient monitoring, no incident response capability
    • A10 Server-Side Request Forgery (SSRF) — Unvalidated URL parameters, internal service access, cloud metadata endpoints
  3. Framework-Specific Analysis — Apply checks for detected framework (React, Angular, Vue, Express, Django, Flask, Rails, Spring, ASP.NET, Laravel).
  4. Configuration Review — Examine web server configs (nginx, Apache), application configs, and deployment manifests for security settings.
  1. 应用映射 — 识别框架/编程语言、部署模式（单体/微服务）、信任边界（互联网/内部/本地）、数据敏感度（PII、财务、健康数据）以及认证机制。
  2. 评估每项OWASP Top 10风险:
    • A01 访问控制失效 — 缺少权限检查、IDOR、权限提升、路径遍历、CORS配置错误
    • A02 加密机制失效 — 弱算法、缺少TLS、硬编码密钥、密钥管理不当、明文存储
    • A03 注入攻击 — SQLi、NoSQLi、操作系统命令注入、LDAP注入、XSS、SSTI、XPath注入
    • A04 不安全设计 — 缺少安全需求、业务逻辑缺陷、不安全工作流、威胁建模漏洞
    • A05 安全配置错误 — 默认配置、详细错误信息泄露、缺少安全头、不必要功能启用、组件过时
    • A06 易受攻击的组件 — 未打补丁的库、不再受支持的依赖、缺少组件清单、缺失SBOM
    • A07 身份识别与认证失效 — 弱密码、会话问题、MFA缺失、凭证填充、暴力破解
    • A08 软件与数据完整性失效 — 不安全反序列化、未签名的更新、CI/CD攻击、依赖混淆
    • A09 安全日志与监控失效 — 缺少审计日志、监控不足、无事件响应能力
    • A10 服务端请求伪造（SSRF） — URL参数未验证、访问内部服务、云元数据端点
  3. 框架专项分析 — 针对检测到的框架（React、Angular、Vue、Express、Django、Flask、Rails、Spring、ASP.NET、Laravel）应用对应检查项。
  4. 配置审查 — 检查Web服务器配置（nginx、Apache）、应用配置以及部署清单中的安全设置。

Output

输出

Application overview, risk matrix for all 10 categories with severity/status, detailed findings using 
templates/finding.md
, positive controls observed, and prioritized remediation roadmap.
应用概述、包含所有10类风险的严重程度/状态的风险矩阵、使用
templates/finding.md
生成的详细发现结果、已观察到的有效安全控制措施，以及优先级排序的修复路线图。

OWASP References

OWASP参考资料

  • OWASP Top 10 for Web Applications (2021)
  • OWASP ASVS v5.0 — Application Security Verification Standard
  • OWASP Testing Guide (WSTG)
  • OWASP Cheat Sheet Series
  • Web应用OWASP Top 10（2021版）
  • OWASP ASVS v5.0 — 应用安全验证标准
  • OWASP测试指南（WSTG）
  • OWASP Cheat Sheet系列