Website Penetration Testing Basics: OWASP Top 10 Vulnerability Guide

Website Penetration Testing Basics: OWASP Top 10 Vulnerability Guide

OWASP Top 10 is the most authoritative vulnerability classification standard for web application security.

1. OWASP Top 10 (2026 Edition)

A01: Broken Access Control

Attackers can access unauthorized functions or data.

Common scenarios: Modifying URL IDs to access other users' data, unauthorized deletion, accessing admin pages without login.

Fix: Check user permissions on every request, use middleware for unified auth.

A02: Cryptographic Failures

Sensitive data not properly encrypted.

Common issues: HTTP instead of HTTPS, MD5/SHA1 for passwords, unencrypted credit card numbers.

Fix: Use password_hash() with bcrypt.

A03: Injection

SQL, command, and LDAP injections.

Fix: Use prepared statements (PDO), never concatenate SQL strings.

A04: Insecure Design

Architecture-level security flaws.

Fix: Server-side price validation, rate limiting on APIs.

A05: Security Misconfiguration

Default configs, unpatched vulnerabilities, directory listing.

Checklist: Delete default accounts, disable directory listing, remove debug info, update all components.

A06: Vulnerable Components

Using third-party components with known vulnerabilities.

npm audit --production
composer audit
pip list --outdated

A07: Identification and Authentication Failures

Weak passwords, no login limits, session fixation.

Fix: Password strength requirements, login attempt limits.

A08: Software and Data Integrity Failures

CI/CD pipeline security issues.

Fix: Verify library signatures, use lock files, code signing.

A09: Security Logging and Monitoring Failures

Cannot detect and respond to security events in time.

Requirements: Log all login attempts, permission changes, sensitive data operations.

A10: Server-Side Request Forgery (SSRF)

Attackers use the server to make internal network requests.

Fix: URL whitelist, disable HTTP redirects.

2. Penetration Testing Tools

3. Fix Priorities

High (fix immediately): SQL injection, broken access control, stored XSS, data leaks
Medium (fix within week): Reflected XSS, CSRF, security misconfiguration
Low (fix within month): Missing security headers, incomplete logging

4. Organizing a Penetration Test

Before reading a report, think about how to organize the test itself. A standard web penetration test usually has five phases:

1. Scope definition: clarify which domains, endpoints, and account levels are in scope, and obtain written authorization. Scanning without authorization is intrusion, not testing.
2. Reconnaissance: map the attack surface via subdomain enumeration, fingerprinting, and directory brute-forcing. Common tools: subfinder, httpx, ffuf.
3. Automated scanning: use OWASP ZAP or Burp as a baseline to cover common injection, XSS, and misconfigurations.
4. Manual verification: confirm each finding by hand to filter false positives, and test core flows (login, payment, upload) in depth.
5. Report and retest: deliver a risk-ranked report, then retest after fixes.

# Common recon commands
subfinder -d example.com -silent | httpx -silent -status-code
ffuf -w /usr/share/wordlists/dirb/common.txt -u https://example.com/FUZZ

A workable test plan should include at least these elements:

A Small E-Commerce Site Test Case

Take a small e-commerce site doing $5M in annual sales running its first penetration test. Automated scanning flags 12 medium-to-high findings; manual retesting confirms five real ones: a stored XSS in product reviews (HTML is not filtered), an IDOR endpoint at /api/order/ (order ownership is not checked), an open directory listing, a weak admin password, and a missing CSP header. Priorities are clear: fix the IDOR and stored XSS the same day, tighten the password policy, and handle the rest within two weeks. The key point: the number of findings is not what matters — knowing which are real and which to fix first is.

5. Summary

Penetration testing is a continuous process integrated into the development cycle. Use OWASP ZAP for regular scanning plus manual testing for key functions.