OWASP Web Top 10 Risks
The OWASP Web Top 10 risks are described in the following sections.
A1. Injection
As noted previously, SQL injection involves changing the ID in the query string to see what you can find—for example, trying something like http://example.com/app/accountView?id=’ or ’1’=’1 to see if the entire data set can be returned. A4 is also a type of injection, where we modify one of the IDs to see if that can return someone else’s account data—for example, where http://example.com/app/accountView?id=’123’ is changed to http://example.com/app/accountView?id=’124’.
A2. Broken Authentication and Session Management
Broken authentication and session management is a failure to secure logins by not protecting the username and passwords. ...
Get Bulletproof Android™: Practical Advice for Building Secure Apps now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
