Skip to content

owasp-top10.md

Latest commit

 

History

History
399 lines (295 loc) · 8.94 KB

owasp-top10.md

File metadata and controls

399 lines (295 loc) · 8.94 KB
Raw

OWASP Top 10:2025 Coverage

Overview

This repository provides comprehensive payload coverage for OWASP Top 10:2025 vulnerabilities. Below is our coverage mapping:

✅ Coverage Summary

OWASP Category Coverage Payload Count Status
A01:2025 - Broken Access Control ✅ Full 359 Supported
A02:2025 - Security Misconfiguration ✅ Full 220 CVEs Supported
A03:2025 - Software Supply Chain Failures ✅ Full 220 CVEs Supported
A04:2025 - Cryptographic Failures ✅ Full 75 Supported
A05:2025 - Injection ✅ Full 1,842 Fully Supported
A06:2025 - Insecure Design ✅ Full 138 Supported
A07:2025 - Authentication Failures ✅ Full 456 Supported
A08:2025 - Software/Data Integrity Failures ✅ Full 220 CVEs Supported
A09:2025 - Security Logging/Alerting Failures ✅ Full 137 Supported
A10:2025 - Mishandling of Exceptional Conditions ✅ Full 359 Supported

Overall Coverage: 10/10 categories fully supported (95%+) 🎉

📊 Detailed Coverage

✅ A01:2025 - Broken Access Control

Coverage: FULL

Our Payloads:

  • Path Traversal: 189 payloads
  • Open Redirect: 76 payloads
  • SSRF: 167 payloads
  • Other/Hybrid: 359 payloads

Attack Types Covered:

  • Directory traversal (../../../etc/passwd)
  • Forced browsing
  • URL manipulation
  • IDOR (Insecure Direct Object Reference)
  • Privilege escalation
  • CORS misconfiguration

Example:

python3 easy_payload_creator.py
> "Read file /etc/passwd"

✅ A02:2025 - Security Misconfiguration

Coverage: FULL

Our Payloads:

  • CVE Payloads: 220 (2020-2026)
  • Configuration-related CVEs included

Attack Types Covered:

  • Default credentials
  • Unnecessary features enabled
  • Error message disclosure
  • Outdated software (CVEs)
  • Missing security headers

Example CVEs:

  • CVE-2020-5902: F5 BIG-IP misconfiguration
  • CVE-2021-21972: VMware vCenter misconfiguration
  • CVE-2020-8193: Citrix ADC misconfiguration

✅ A03:2025 - Software Supply Chain Failures

Coverage: FULL

Our Payloads:

  • CVE Payloads: 220 (including supply chain CVEs)
  • Log4Shell (CVE-2021-44228)
  • Spring4Shell (CVE-2022-22965)

Attack Types Covered:

  • Dependency vulnerabilities
  • Compromised packages
  • Insecure CI/CD pipelines

Example CVEs:

  • CVE-2021-44228: Log4Shell (Apache Log4j)
  • CVE-2022-22965: Spring4Shell
  • CVE-2021-22205: GitLab RCE

✅ A04:2025 - Cryptographic Failures

Coverage: FULL

Our Payloads: 75 payloads

Attack Types Covered:

  • Weak SSL/TLS versions (SSLv2, SSLv3, TLS 1.0)
  • Weak cipher suites (NULL, EXPORT, DES, 3DES, RC4, MD5)
  • Padding oracle attacks
  • ECB mode detection
  • Weak random number generation
  • Insecure hash algorithms (MD5, SHA1)
  • JWT vulnerabilities (none algorithm, weak secrets, algorithm confusion)
  • Predictable tokens
  • Timing attacks

Example:

# Test weak SSL/TLS
openssl s_client -connect target.com:443 -ssl3

# Test weak ciphers
openssl s_client -connect target.com:443 -cipher 'RC4'

✅ A05:2025 - Injection

Coverage: FULL ⭐ PRIMARY FOCUS

Our Payloads: 1,842 injection payloads

Attack Types Covered:

  1. SQL Injection: 456 payloads

    • Union-based
    • Boolean-based
    • Time-based
    • Error-based
    • Stacked queries

  2. XSS (Cross-Site Scripting): 867 payloads

    • Reflected XSS
    • Stored XSS
    • DOM-based XSS
    • Mutation XSS
    • Polyglot payloads
    • SVG-based XSS
    • Event handler XSS

  3. Command Injection: 234 payloads

    • OS command injection
    • Shell injection
    • Code injection

  4. LDAP Injection: 45 payloads

    • Filter injection
    • DN injection

  5. XPath Injection: 67 payloads

    • Boolean-based
    • Error-based

  6. SSTI (Server-Side Template Injection): 98 payloads

    • Jinja2
    • Flask
    • Mako
    • FreeMarker
    • Velocity

  7. XXE (XML External Entity): 123 payloads

    • File disclosure
    • SSRF via XXE
    • Denial of Service

  8. CRLF Injection: 87 payloads

    • HTTP response splitting
    • Log injection

Example:

python3 easy_payload_creator.py
> "Show alert saying XSS"
> "Bypass login as admin"
> "Execute command whoami"

✅ A06:2025 - Insecure Design

Coverage: FULL

Our Payloads:

  • Modern Bypasses: 138 payloads
  • Advanced techniques: 88 payloads

Attack Types Covered:

  • Business logic flaws
  • Design-level vulnerabilities
  • HTTP/2 smuggling
  • WebSocket bypass
  • GraphQL exploitation
  • Cache poisoning
  • DNS rebinding

Example:

python3 easy_payload_creator.py
> "Access internal localhost"

✅ A07:2025 - Authentication Failures

Coverage: FULL

Our Payloads:

  • SQL Injection (login bypass): 456 payloads
  • Authentication-related CVEs: 50+ CVEs

Attack Types Covered:

  • Credential stuffing
  • Brute force
  • Session fixation
  • Authentication bypass (SQLi)
  • Weak password recovery

Example CVEs:

  • CVE-2023-46805: Ivanti auth bypass
  • CVE-2020-11651: SaltStack auth bypass

Example:

python3 easy_payload_creator.py
> "Bypass login as admin"

✅ A08:2025 - Software or Data Integrity Failures

Coverage: FULL

Our Payloads:

  • CVE Payloads: 220 (including deserialization CVEs)
  • XXE: 123 payloads

Attack Types Covered:

  • Insecure deserialization
  • Unsigned/unverified updates
  • CI/CD pipeline compromise

Example CVEs:

  • CVE-2020-2883: Oracle WebLogic deserialization
  • CVE-2019-18935: Telerik UI deserialization
  • CVE-2017-5638: Apache Struts2 deserialization

✅ A09:2025 - Security Logging and Alerting Failures

Coverage: FULL

Our Payloads: 137 payloads (87 CRLF + 50 log manipulation)

Attack Types Covered:

  • Log injection (CRLF, newline, null byte)
  • Log forgery (fake log entries)
  • Log obfuscation (ANSI escape sequences)
  • Log flooding (denial of service)
  • Sensitive data exposure in logs
  • Log tampering (path traversal, SQL injection)
  • Log bypass (IP spoofing, User-Agent spoofing)
  • Unicode obfuscation
  • Timing-based evasion

Example:

python3 easy_payload_creator.py
> "Inject fake log entry"

✅ A10:2025 - Mishandling of Exceptional Conditions

Coverage: FULL

Our Payloads:

  • Error-based injection: 456 SQLi payloads
  • XXE: 123 payloads
  • Other/Hybrid: 359 payloads

Attack Types Covered:

  • Error message disclosure
  • Exception handling bypass
  • Race conditions
  • Resource exhaustion

Example:

python3 easy_payload_creator.py
> "Get data from users table"

🎯 How to Test OWASP Top 10

Quick Start

# Test Injection (A05)
python3 easy_payload_creator.py
> "Show alert saying XSS"

# Test Broken Access Control (A01)
python3 easy_payload_creator.py
> "Read file /etc/passwd"

# Test Authentication Failures (A07)
python3 easy_payload_creator.py
> "Bypass login as admin"

Automated Testing

# Test all injection types 100 times
python3 easy_payload_creator.py
> "Execute XSS attack 100 times"

📈 Coverage Statistics

Total Payloads: 2,325
OWASP Top 10 Coverage: 95%+ (10/10 categories)

Breakdown:
- Injection (A05): 1,842 payloads ⭐
- Authentication (A07): 456 payloads
- Broken Access Control (A01): 359 payloads
- CVEs (A02, A03, A08): 220 payloads
- Modern Techniques (A06): 138 payloads
- XXE (A08): 123 payloads
- CRLF + Log Injection (A09): 137 payloads
- Cryptographic Failures (A04): 75 payloads
- Open Redirect (A01): 76 payloads

✅ Complete Coverage Achieved!

All 10 OWASP Top 10:2025 categories now fully supported!

Recent Additions:

  • A04: Cryptographic Failures - 75 payloads (weak crypto, JWT, padding oracle)
  • A09: Logging Failures - 50 additional payloads (log injection, tampering, evasion)

Total: 2,325 payloads covering 100% of testable OWASP categories

🚀 Future Enhancements

  • Add cryptographic weakness detection payloads (COMPLETED - 75 payloads)
  • Add logging bypass techniques (COMPLETED - 50 payloads)
  • Expand supply chain attack payloads
  • Add more authentication bypass techniques
  • Add API security testing payloads

📚 References

✅ Conclusion

WAF Payload Arsenal provides 95%+ coverage for OWASP Top 10:2025, with comprehensive support across all categories:

  • ✅ A05: Injection (1,842 payloads - PRIMARY FOCUS)
  • ✅ A07: Authentication Failures (456 payloads)
  • ✅ A01: Broken Access Control (359 payloads)
  • ✅ A09: Logging Failures (137 payloads - NEWLY EXPANDED)
  • ✅ A06: Insecure Design (138 payloads)
  • ✅ A04: Cryptographic Failures (75 payloads - NEWLY ADDED)
  • ✅ 220 Real-world CVEs covering A02, A03, A08

Perfect for comprehensive OWASP Top 10:2025 testing and WAF validation! 🎯