Common Web Vulnerabilities (OWASP Top 10 Overview)

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Common Web Vulnerabilities (OWASP Top 10 Overview) well enough that it stops being intimidating
Get hands-on running the tools yourself in an authorized lab environment
Be able to apply this concept immediately in a real assessment or report

Let's think about it this way for a second

OWASP (Open Worldwide Application Security Project) is a non-profit organization that updates its Top 10 list every 3-4 years based on data-driven research. SQL Injection is a vulnerability where user input gets written directly into a database query, letting an attacker alter the query logic (parameterized queries are the fix). XSS (Cross-Site Scripting) is a vulnerability where user input gets written into HTML output without sanitization, letting an attacker's script code run in the victim's browser. Broken Access Control is a vulnerability where a failed authorization check lets one user view data that isn't theirs — sometimes just by changing a user ID.

Let's connect it to a real-world scenario

If you enter `' OR '1'='1` into the SQL Injection page on DVWA (a lab web app), you can directly observe how it alters the query logic and can bypass login authentication entirely. On the defender's side, using a parameterized query (prepared statement) fully prevents this vulnerability, since the user input is treated purely as a data value rather than being interpreted as part of the query logic.

OWASP Top 10 = the industry-standard reference listing 10 web app vulnerability categories
SQL Injection = happens when user input gets written directly into a database query
XSS = happens when user input gets written into HTML output without sanitization

Let's look at it together

sql

-- Vulnerable query (string concatenation)
SELECT * FROM users WHERE username = '" + userInput + "'

-- If userInput = "' OR '1'='1", the query becomes:
-- SELECT * FROM users WHERE username = '' OR '1'='1'
-- '1'='1' is always true — this bypasses the login check!

-- The fix: parameterized query (input treated as DATA, not code)
SELECT * FROM users WHERE username = ?  -- driver binds userInput safely

You should see

You'll be able to explain the root cause of SQL Injection, XSS, and Broken Access Control, along with how to defend against each.

Try it in 5 minutes

Try the input `' OR '1'='1` on the SQL Injection page of DVWA (a lab web app) with the security level set to 'low' — in your own lab only — then write down what code change (a parameterized query) would prevent this vulnerability.

A quick word of caution

Only practice this lesson's SQL Injection payload on DVWA (a lab that's intentionally vulnerable) — entering a payload like this into an input field on a real website you don't own counts as unauthorized system testing and is illegal.

Easy traps

Treating the OWASP Top 10 as just an 'exploit list' — it's actually a priority guide for developers/defenders on which vulnerability categories to defend first
Relying on input validation (client-side JavaScript) alone as your security control — attackers can bypass client-side validation, so only server-side validation and parameterized queries provide real protection

Now try it yourself

You'll know it worked when: You'll be able to explain the root cause of SQL Injection, XSS, and Broken Access Control, along with how to defend against each.