Application Security Testing: OWASP Top 10, SAST, DAST and SCA Training Course

A01:2025 – Broken Access Control

Access control mechanisms enforce policies to ensure users cannot act beyond their intended permissions. Failures in this area often result in unauthorized information disclosure, modification, or destruction of data, or the execution of business functions outside a user's authorized limits.

Practical Aspects

• Practical examples of broken access controls.

• Secure access control implementations and best practices.

A02:2025 – Security Misconfiguration

Security misconfiguration occurs when systems, applications, or cloud services are set up incorrectly from a security standpoint, thereby introducing vulnerabilities.

Practical Aspects

• Real-world examples of common misconfigurations.

• Strategies to prevent misconfiguration, including the use of configuration management and automation tools.

A03:2025 – Software Supply Chain Failures

These failures represent breakdowns or compromises in the process of building, distributing, or updating software. They are frequently caused by vulnerabilities or malicious alterations in third-party code, tools, or other dependencies upon which the system relies.

A04:2025 – Cryptographic Failures

Generally, all data in transit should be encrypted at the transport layer (OSI layer 4). Previous challenges, such as CPU performance constraints and complex private key/certificate management, have been largely mitigated by modern CPUs with instructions for accelerated encryption (e.g., AES support) and services like LetsEncrypt.org, along with cloud vendors providing tightly integrated certificate management.

Beyond securing the transport layer, it is crucial to determine which data requires encryption at rest and which data needs additional encryption in transit at the application layer (OSI layer 7).

Sensitive data such as passwords, credit card numbers, health records, personal information, and business secrets requires extra protection, particularly when subject to privacy laws like the EU's General Data Protection Regulation (GDPR) or regulations such as the PCI Data Security Standard (PCI DSS).

Practical Aspects

• Detailed analysis of cryptographic failures, such as the use of weak encryption algorithms or improper key management.

• The importance of strong cryptographic mechanisms, secure protocols (SSL/TLS), and examples of modern cryptography in web security.

A05:2025 – Injection

Injection vulnerabilities are system flaws that allow attackers to insert malicious code or commands (such as SQL or shell code) into input fields, tricking the system into executing them as if they were legitimate parts of the system. This can lead to severe consequences.

Practical Aspects

• A detailed breakdown of SQL, NoSQL, OS, and LDAP injection techniques.

• Mitigation techniques using prepared statements, parameterized queries, and input escaping.

A06:2025 – Insecure Design

Insecure design is a broad category representing various weaknesses, often described as missing or ineffective control design.

It is important to distinguish insecure design from insecure implementation. They are different because they stem from different root causes, occur at different stages of the development process, and require different remediation approaches.

A secure design can still suffer from implementation defects that lead to exploitable vulnerabilities. Conversely, an insecure design cannot be fixed by perfect implementation if the necessary security controls were never designed to defend against specific attacks.

A contributing factor to insecure design is the lack of business risk profiling inherent in the software or system being developed, leading to a failure to determine the required level of security design.

Practical Aspects

• Exploring design flaws that can lead to vulnerabilities, such as improper input validation.

• Studying strategies for secure architecture and secure design principles.

A07:2025 – Authentication Failures

This vulnerability is present when an attacker can trick a system into recognizing an invalid or incorrect user as legitimate.

Practical Aspects

• Common authentication issues and pitfalls.

• Secure authentication strategies, including multi-factor authentication and proper session handling.

A08:2025 – Software or Data Integrity Failures

These failures relate to code and infrastructure that fails to prevent invalid or untrusted code and data from being treated as trusted and valid.

An example includes applications that rely on plugins, libraries, or modules from untrusted sources, repositories, or content delivery networks (CDNs).

An insecure CI/CD pipeline that lacks software integrity checks can introduce risks of unauthorized access, malicious code insertion, or system compromise.

Another example is a CI/CD process that pulls code or artifacts from untrusted locations without verifying their signatures or integrity before use.

Practical Aspects

• Focusing on issues such as untrusted software updates and data tampering.

• Implementing safe update mechanisms and data integrity checks.

A09:2025 – Security Logging and Alerting Failures

Without robust logging and monitoring, attacks and breaches often go undetected. Furthermore, without effective alerting, it becomes difficult to respond quickly and effectively to security incidents.

Insufficient logging, continuous monitoring, detection, and alerting for active response is a persistent issue.

Practical Aspects

• The importance of logging security-relevant information and monitoring for suspicious activities.

• Tools and practices for proper logging and real-time monitoring to detect breaches early.

A10:2025 – Mishandling of Exceptional Conditions

Mishandling exceptional conditions occurs when programs fail to prevent, detect, and respond to unusual or unpredictable situations, leading to crashes, unexpected behavior, and potential vulnerabilities.

This typically involves one or more of the following failings:

• The application fails to prevent an unusual situation from occurring.

• The application fails to identify the situation as it is happening.

• The application responds poorly or not at all to the situation afterwards.

SAST – Static Application Security Testing

1. Understanding static analysis and the timing of its execution within the SDLC (shift left).

2. Types of vulnerabilities detectable through SAST, comparing vulnerable code with secure code.

3. Overview of SAST tools (e.g., Semgrep, SonarQube, Checkmarx, depending on the client stack).

4. Practical exercise: Run a SAST scan on a repository with deliberately introduced vulnerabilities, interpret the results, and triage false positives versus real vulnerabilities.

DAST – Dynamic Application Security Testing

1. Differences between SAST and DAST, focusing on black box testing of running applications.

2. The DAST scan flow, including crawling, fuzzing, and response analysis.

3. Overview of DAST tools (e.g., OWASP ZAP, Burp Suite).

4. Practical exercise: Run a DAST scan on a vulnerable test application (e.g., OWASP Juice Shop), and identify and validate the findings.

SCA – Software Composition Analysis

1. Risks associated with third-party dependencies and libraries, including inherited vulnerabilities.

2. Understanding the Software Bill of Materials (SBOM), its definition, and its importance.

3. Overview of SCA tools (e.g., Dependency Check, Snyk, GitHub Dependabot).

4. Practical exercise: Run an SCA scan on a real project, identify vulnerable dependencies, and build a remediation plan (update, patch, or mitigate).