OWASPTOP10_owasptop10资源-CSDN文库

4星 · 超过85%的资源需积分: 10 5 浏览量 2010-10-02 05:36:50 上传评论收藏 2.52MB PDF 举报

### OWASP Top 10 Web应用漏洞概览 #### 关于OWASP OWASP（开放Web应用程序安全项目）是一个开放社区，旨在通过提供免费资源帮助组织和个人改进软件的安全性。自2003年成立以来，OWASP已经成为全球范围内网络安全领域的权威之一。该项目不仅包括教育、工具、会议和活动，还涉及广泛的文档编写工作，如本文档所述的“OWASP Top 10”。 #### 版权声明与许可本文档遵循Creative Commons Attribution Share Alike 3.0许可证。任何再利用或分发此文档时，必须清晰地向他人展示该工作的许可证条款。这一规定确保了OWASP的贡献者和参与者能够共享他们的研究成果，同时保持一定的版权控制。 #### 前言随着数字化基础设施变得越来越复杂和互联，保障应用程序安全的难度也呈指数级增长。不安全的软件正在威胁我们的金融、医疗保健、国防、能源等关键基础设施的安全。OWASP Top 10项目的初衷是通过识别一些最紧迫的风险来提高人们对应用程序安全性的认识。该项目被众多标准、书籍、工具和组织引用，包括MITRE、PCIDSS、DISA、FTC等。 #### OWASP Top 10的历史与发展 OWASP Top 10首次发布于2003年，并在2004年和2007年进行了小规模更新，2010年版则是该项目持续提升公众对应用程序风险认识的第八个年头。本报告鼓励各组织机构利用这些知识来启动自己的应用程序安全性计划。开发者可以从其他组织的错误中学习，而管理层则应该开始思考如何管理因软件应用产生的风险。 #### OWASP Top 10的核心内容 OWASP Top 10不仅是一份简单的列表，它旨在为组织提供一个强大的培训、标准和工具的基础，使编写安全代码成为可能。在此基础上，组织应将安全性集成到其开发、验证和维护过程中。管理层可以利用这些活动产生的数据来管理与应用程序安全性相关的成本和风险。 #### 2010版OWASP Top 10的十大风险 1. **注入攻击**：通过输入恶意代码到应用程序中以改变执行逻辑。 2. **跨站脚本(XSS)**：攻击者在受害者的浏览器上执行恶意脚本，以窃取会话令牌或进行其他恶意操作。 3. **不安全的对象直接引用**：攻击者直接访问并修改其他用户的资源。 4. **不安全的配置管理**：默认设置、不必要的功能和服务导致安全漏洞。 5. **敏感数据暴露**：未加密或未正确保护的数据存储和传输可能导致敏感信息泄露。 6. **缺少功能级别的授权**：应用程序没有适当的权限控制，允许未经授权的用户执行某些功能。 7. **跨站点请求伪造(CSRF)**：攻击者诱使已登录用户执行非预期的操作。 8. **未验证的重定向和转发**：攻击者通过操纵重定向或转发来欺骗用户访问恶意网站。 9. **组件存在已知漏洞**：使用过时或含有已知漏洞的第三方组件增加了攻击风险。 10. **信息泄露和错误处理不当**：错误消息透露过多的信息，有助于攻击者了解应用程序结构和漏洞。 #### 结论 OWASP Top 10不仅仅是一份列出常见漏洞的列表，它更是一种方法论，旨在帮助组织建立全面的应用程序安全性计划。通过采用这些最佳实践和技术，企业可以显著减少其应用程序面临的安全风险，从而保护客户数据和业务资产免受潜在的威胁。此外，OWASP还欢迎来自各界的意见和建议，鼓励大家参与到这个持续发展的项目中来。

资源推荐

资源详情

资源评论

About OWASP

This document is released under the Creative Commons Attribution ShareAlike 3.0 license. For any reuse

or distribution, you must make clear to others the license terms of this work.

Foreword

Insecure software is already undermining our financial,

healthcare, defense, energy, and other critical infrastructure.

As our digital infrastructure gets increasingly complex and

interconnected, the difficulty of achieving application

security increases exponentially. We can no longer afford to

tolerate relatively simple security problems like those

presented in the OWASP Top 10.

The goal of the Top 10 project is to raise awareness about

application security by identifying some of the most critical

risks facing organizations. The Top 10 project is referenced

by many standards, books, tools, and organizations, including

MITRE, PCI DSS, DISA, FTC, and many more. This release of

the OWASP Top 10 marks this project’s eighth year of raising

awareness of the importance of application security risks.

The OWASP Top 10 was first released in 2003, minor updates

were made in 2004 and 2007, and this is the 2010 release.

We encourage you to use the Top 10 to get your organization

started with application security. Developers can learn from

the mistakes of other organizations. Executives should start

thinking about how to manage the risk that software

applications create in their enterprise.

But the Top 10 is not an application security program. Going

forward, OWASP recommends that organizations establish a

strong foundation of training, standards, and tools that

makes secure coding possible. On top of that foundation,

organizations should integrate security into their

development, verification, and maintenance processes.

Management can use the data generated by these activities

to manage cost and risk associated with application security.

We hope that the OWASP Top 10 is useful to your application

security efforts. Please don’t hesitate to contact OWASP with

your questions, comments, and ideas, either publicly to

OWASP-TopTen@lists.owasp.org or privately to

dave.wichers@owasp.org.

http://www.owasp.org/index.php/Top_10

About OWASP

The Open Web Application Security Project (OWASP) is an

open community dedicated to enabling organizations to

develop, purchase, and maintain applications that can be

trusted. At OWASP you’ll find free and open …

• Application security tools and standards

• Complete books on application security testing, secure

code development, and security code review

• Standard security controls and libraries

• Local chapters worldwide

• Cutting edge research

• Extensive conferences worldwide

• Mailing lists

• And more … all at www.owasp.org

All of the OWASP tools, documents, forums, and chapters are

free and open to anyone interested in improving application

security. We advocate approaching application security as a

people, process, and technology problem, because the most

effective approaches to application security require

improvements in all of these areas.

OWASP is a new kind of organization. Our freedom from

commercial pressures allows us to provide unbiased, practical,

cost-effective information about application security. OWASP

is not affiliated with any technology company, although we

support the informed use of commercial security technology.

Similar to many open-source software projects, OWASP

produces many types of materials in a collaborative, open way.

The OWASP Foundation is the non-profit entity that ensures

the project’s long-term success. Almost everyone associated

with OWASP is a volunteer, including the OWASP Board,

Global Committees, Chapter Leaders, Project Leaders, and

project members. We support innovative security research

with grants and infrastructure.

Come join us!

Welcome

Welcome to the OWASP Top 10 2010! This significant update presents a more concise, risk focused list of the Top 10 Most

Critical Web Application Security Risks. The OWASP Top 10 has always been about risk, but this update makes this much more

clear than previous editions. It also provides additional information on how to assess these risks for your applications.

For each item in the top 10, this release discusses the general likelihood and consequence factors that are used to categorize the

typical severity of the risk. It then presents guidance on how to verify whether you have problems in this area, how to avoid

them, some example flaws, and pointers to links with more information.

The primary aim of the OWASP Top 10 is to educate developers, designers, architects, managers, and organizations about the

consequences of the most important web application security weaknesses. The Top 10 provides basic techniques to protect

against these high risk problem areas – and also provides guidance on where to go from here.

Warnings

Don’t stop at 10. There are hundreds of issues that could

affect the overall security of a web application as discussed in

the OWASP Developer’s Guide. This is essential reading for

anyone developing web applications today. Guidance on how

to effectively find vulnerabilities in web applications are

provided in the OWASP Testing Guide and OWASP Code

Review Guide, which have both been significantly updated

since the previous release of the OWASP Top 10.

Constant change. This Top 10 will continue to change. Even

without changing a single line of your application’s code, you

may already be vulnerable to something nobody ever

thought of before. Please review the advice at the end of the

Top 10 in “What’s Next For Developers, Verifiers, and

Organizations” for more information.

Think positive. When you’re ready to stop chasing

vulnerabilities and focus on establishing strong application

security controls, OWASP has just produced the Application

Security Verification Standard (ASVS) as a guide to

organizations and application reviewers on what to verify.

Use tools wisely. Security vulnerabilities can be quite

complex and buried in mountains of code. In virtually all

cases, the most cost-effective approach for finding and

eliminating these weaknesses is human experts armed with

good tools.

Push left. Secure web applications are only possible when a

secure software development lifecycle is used. For guidance

on how to implement a secure SDLC, we recently released

the Open Software Assurance Maturity Model (SAMM),

which is a major update to the OWASP CLASP Project.

Acknowledgements

Thanks to Aspect Security for initiating, leading, and updating

the OWASP Top 10 since its inception in 2003, and to its

primary authors: Jeff Williams and Dave Wichers.

We’d like to thank those organizations that contributed their

vulnerability prevalence data to support the 2010 update:

 Aspect Security

 MITRE – CVE

 Softtek

 WhiteHat Security Inc. – Statistics

We’d also like to thank those who have contributed significant

content or time reviewing this update of the Top 10:

 Mike Boberski (Booz Allen Hamilton)

 Juan Carlos Calderon (Softtek)

 Michael Coates (Aspect Security)

 Jeremiah Grossman (WhiteHat Security Inc.)

 Jim Manico (for all the Top 10 podcasts)

 Paul Petefish (Solutionary Inc.)

 Eric Sheridan (Aspect Security)

 Neil Smithline (OneStopAppSecurity.com)

 Andrew van der Stock

 Colin Watson (Watson Hall, Ltd.)

 OWASP Denmark Chapter (Led by Ulf Munkedal)

 OWASP Sweden Chapter (Led by John Wilander)

Introduction

What changed from 2007 to 2010?

The threat landscape for Internet applications constantly changes. Key factors in this evolution are advances made by attackers,

the release of new technology, as well as the deployment of increasingly complex systems. To keep pace, we periodically update

the OWASP Top 10. In this 2010 release, we have made three significant changes:

1) We clarified that the Top 10 is about the Top 10 Risks, not the Top 10 most common weaknesses. See the details on the

“Application Security Risks” page below.

2) We changed our ranking methodology to estimate risk, instead of relying solely on the frequency of the associated

weakness. This has affected the ordering of the Top 10, as you can see in the table below.

3) We replaced two items on the list with two new items:

+ ADDED: A6 – Security Misconfiguration. This issue was A10 in the Top 10 from 2004: Insecure Configuration

Management, but was dropped in 2007 because it wasn’t considered to be a software issue. However, from an

organizational risk and prevalence perspective, it clearly merits re-inclusion in the Top 10; so now it’s back.

+ ADDED: A10 – Unvalidated Redirects and Forwards. This issue is making its debut in the Top 10. The evidence shows that

this relatively unknown issue is widespread and can cause significant damage.

– REMOVED: A3 – Malicious File Execution. This is still a significant problem in many different environments. However, its

prevalence in 2007 was inflated by large numbers of PHP applications having this problem. PHP now ships with a more

secure configuration by default, lowering the prevalence of this problem.

– REMOVED: A6 – Information Leakage and Improper Error Handling. This issue is extremely prevalent, but the impact of

disclosing stack trace and error message information is typically minimal. With the addition of Security Misconfiguration

this year, proper configuration of error handling is a big part of securely configuring your application and servers.

OWASP Top 10 – 2007 (Previous)

OWASP Top 10 – 2010 (New)

A2 – Injection Flaws

A1 – Injection

A1 – Cross Site Scripting (XSS)

A2 – Cross-Site Scripting (XSS)

A7 – Broken Authentication and Session Management

A3 – Broken Authentication and Session Management

A4 – Insecure Direct Object Reference

A4 – Insecure Direct Object References

A5 – Cross Site Request Forgery (CSRF)

A5 – Cross-Site Request Forgery (CSRF)

A6 – Security Misconfiguration (NEW)

A8 – Insecure Cryptographic Storage

A7 – Insecure Cryptographic Storage

A10 – Failure to Restrict URL Access

A8 – Failure to Restrict URL Access

A9 – Insecure Communications

A9 – Insufficient Transport Layer Protection

A10 – Unvalidated Redirects and Forwards (NEW)

A3 – Malicious File Execution

A6 – Information Leakage and Improper Error Handling

Release Notes

剩余21页未读，继续阅读

评论收藏

内容反馈

superjtc

2011-10-11

是英文资料，下载的同学注意。。东西还是蛮不错的。
mao234

2012-11-13

好资料，可惜是2010年，不知有没有2011年的

zwdeng

粉丝: 0
资源: 2

OWASP TOP 10

最新资源

OWASP TOP 10

OWASP top 10

OWASP TOP 10 2021年图片版

OWASP Top 10 2013

OWASP Top 10 2017

OWASP TOP 10的介绍和应用

OWASP Top 10_2010

OWASP Top 10 2017 v1.3中文最新版.pdf

OWASP-TOP10-2021中文版V1.0发布

OWASP Top 10 2017-RC1-4e2d65877248-V1.0.pdf

OWASP Top 10阅读笔记

OWASP TOP10 2010WEB安全(中文版)

OWASP Top 10 2017（RC2）中文版

OWASP Top 10 - 2010

OWASP Top 10 2017 10项最严重的 Web 应用程序安全风险

OWASP_Top_10_-_2010

OWASP无服务器应用安全风险TOP 10.pdf

OWASP-TOP10-2021中文版V1.0

OWASP_TOP_10(2013)_java_开发安全实践.pdf

OWASP Top 10 2017.pdf

AI安全 OWASP_TOP_10（2010中文） - zbrush.zip

2004&2007&2010&2013&2017 OWASP TOP 10.rar

WEB十大安全问题OWASPTOP10.doc

DVWA靶场，集成了owasp top 10漏洞

owasp top10漏洞讲解

最新资源