OWASP Top 10 — বাস্তব আক্রমণ ও প্রতিরোধ

OWASP Top 10 (2021)

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable Components
7. Identification & Auth Failures
8. Software & Data Integrity
9. Logging & Monitoring Failures
10. SSRF

SQL Injection ⭐

input: " OR 1=1 --
SELECT * FROM users WHERE name="" OR 1=1 --"  // returns ALL!

❌ $sql = "SELECT * WHERE name='$name'";
✅ $stmt = $pdo->prepare("SELECT * WHERE name=?");
   $stmt->execute([$name]);
✅ ORM — auto parameterized

XSS (Cross-Site Scripting)

// Stored: comment = "<script>steal(cookie)</script>"
// ✅ Encode output
{{ comment }}  // Vue/Angular auto-escape
${escapeHtml(comment)}

// ❌ innerHTML, v-html, dangerouslySetInnerHTML

CSP ⭐

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://cdn.jsdelivr.net;
  style-src 'self' 'unsafe-inline';

CSRF

// Attacker site auto-submits form to bank.com
// Victim logged in → cookies sent → transfer!

✅ CSRF token per session
✅ SameSite=Strict cookie
✅ Custom header (X-CSRF)

IDOR

// /api/orders/123 → /api/orders/124 → other user's data!
✅ Auth check
if (order.UserId != currentUserId) throw ForbiddenException();

Security Misconfig

• Default creds (admin/admin)
• Verbose errors (stack trace)
• Debug mode in prod
• Old versions, open S3 bucket
• Permissive CORS

Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), camera=()

Vulnerable Components

npm audit, Snyk, Dependabot, OWASP Dependency-Check, SBOM।

SSRF

// img_url = "http://169.254.169.254/..." (AWS metadata!)
✅ Allowlist domains, block private IPs

Mindset

1. Defense in depth
2. Least privilege
3. Fail secure
4. Don't trust input
5. Encrypt sensitive data
6. Log security events
7. Patch regularly