OWASP Top 10 Analysis

Work a web application category-by-category so nothing is skipped.

Checklist by Category (2021)

A01 Broken Access Control

• Test IDOR: swap identifiers (user IDs, UUIDs, filenames) between two test accounts
• Verify server-side enforcement on every endpoint, not just UI hiding
• Try HTTP method overrides, path traversal in IDs, mass assignment on profile updates
• Check forced browsing to admin routes after logout/role downgrade

A02 Cryptographic Failures

• Confirm TLS 1.2+ only, HSTS present
• Find plaintext protocols, hardcoded keys, weak hashes (MD5/SHA1) for passwords
• Passwords hashed with bcrypt/argon2 + per-user salt; secrets not in client bundles