Web application security audit (OWASP Top 10)

Conducting web application security audit (OWASP Top 10)

Security audit following OWASP methodology is a systematic check of the application for vulnerabilities from the list of most critical risks. Includes automated scanning, manual code and business logic analysis, authentication and authorization testing.

OWASP Top 10 (2021): what to check

Phase 1: Reconnaissance and mapping (3–5 days)

Inventory all application entry points:

nmap -sV -sC -p- target.example.com

ffuf -w /usr/share/wordlists/dirb/big.txt \
     -u https://target.example.com/FUZZ \
     -mc 200,301,302,403

katana -u https://target.example.com -jc -d 3

whatweb https://target.example.com
wappalyzer https://target.example.com

Result: complete map of endpoints, technologies used, component versions.

Phase 2: Automated scanning (1–2 days)

zap-cli quick-scan --self-contained \
    --start-options '-config api.disablekey=true' \
    https://target.example.com

nikto -h https://target.example.com -ssl -output report.html

nuclei -u https://target.example.com \
       -t cves/ -t misconfigurations/ \
       -severity critical,high,medium

semgrep --config=p/owasp-top-ten ./src

Phase 3: Authentication and authorization testing (3–5 days)

IDOR — object ID substitution:

GET /api/users/1337/profile      → 200 OK (another user's profile)
GET /api/orders/9999/details     → should return 403, not 200

JWT vulnerabilities:

• Algorithm none — accept without signature
• RS256 → HS256 — forge with public key
• Weak secret — brute force

Phase 4: Injections and client-side attacks (3–4 days)

sqlmap -u "https://target.com/search?q=test" \
       --level=5 --risk=3 --dbs --batch

dalfox url "https://target.com/search?q=test" \
       --output xss_report.txt

Phase 5: Configuration analysis (1–2 days)

testssl.sh --full https://target.example.com
sslyze --regular target.example.com

npm audit --audit-level=moderate
composer audit
pip-audit

gitleaks detect --source . --report-format json
truffleHog git file://. --only-verified

Phase 6: Business logic analysis (2–3 days)

Manual analysis cannot be automated:

• Bypassing payment limits (negative amounts, race conditions)
• Promo code and discount manipulation
• Bypassing email verification
• Insecure direct links to files
• Password reset without old token invalidation

Audit timeline