Stop 12 · Security & Accessibility TestingTopics · 2/7

OWASP Top 10 for Testers

In short

OWASP's Top 10 is the most quoted list of web app security risks. Learn what each one looks like from a tester's chair and you'll spot red flags during normal testing.

The most widely referenced list of critical web application security risks — a tester doesn't need deep security expertise, but should recognize these categories well enough to flag obvious issues.

The purple blob walks around a small house with a torch and clipboard, checking the locks.

Think of it like this

The house safety checklist

Before a long trip, you walk around the house: doors locked, windows latched, gas off, spare key not under the mat. You don't need to be a locksmith. The OWASP Top 10 is that walk-around list for web apps.

Watch it happen

The OWASP Top 10 (2021 edition) in tester language

Access

Crypto

Injection

Design

Misconfig

Old parts

Integrity

Logging

SSRF

1/7These are the ten categories of the 2021 edition. Let's look at what a tester can notice for each.

The big ideas

What you need to know

Categories, not attacks

Each item is a family of problems. You use them as a checklist for test ideas, not as hacking steps.

Access control first

It tops the 2021 list, and testers are well placed to catch it with two test accounts and some curiosity.

The list gets updated

OWASP revises the list every few years. Check owasp.org for the newest edition and what changed.

Flag, don't exploit

When something looks wrong, document what you saw and hand it to the security team. Don't dig further without permission.

How it works

Using the list in a test cycle

1
Pick the relevant items
A login feature maps to access control, crypto and authentication failures.
2
Write test ideas
For each item, add two or three safe checks to your test plan.
3
Run during normal testing
Check them alongside functional tests on your test environment.
4
Report clearly
Log findings with steps, impact and the OWASP category, marked as security.

Save yourself the pain

Common mistakes

Oops

Memorising the ten names for an interview and stopping there.

Do this instead

For each item, be able to give one example a tester could notice in a real app.

Oops

Copying attack payloads from the internet and firing them at any website.

Do this instead

Practise only on deliberately vulnerable labs like OWASP Juice Shop running on your own machine.

Your mission

Map a feature to the Top 10

~25 min

Quick check

You can see another customer's invoice by changing the number in the URL. Which OWASP category is this?

Go deeper

1Read the current OWASP Top 10 list and identify 2 categories most relevant to your testing work.
2Learn to recognize basic signs of SQL injection or XSS vulnerability during exploratory testing.
3Understand this is baseline awareness, not full security testing expertise.