OWASP Top 10 for Modern Web Apps: A Practical Pentester's Field Guide

OWASP Top 10 for Modern Web Apps: A Practical Pentester's Field Guide

Automated vulnerability scanners (like OWASP ZAP or Nuclei) are essential for rapid baseline scans, but they consistently fail to identify business logic bypasses, complex authorization flaws, and multi-step privilege escalation paths.

In this field guide, we examine how senior penetration testers evaluate modern cloud-native architectures against the critical categories of the OWASP Top 10.

1. A01: Broken Access Control (The Most Prevalent Risk)

Broken Access Control remains the #1 vulnerability across web applications. It occurs whenever an application permits a user to act outside their designated privilege boundaries.

IDOR (Insecure Direct Object References)

Pentesters test API parameters by manipulating identifier parameters:

GET /api/v2/invoices/INV-9042 HTTP/1.1
Host: target.app
Authorization: Bearer <Attacker_Token>

If the server fails to verify that INV-9042 belongs to the tenant represented by , confidential financial records are leaked.

Remediation Pattern

Enforce tenant-isolated queries at the database ORM layer:

// Enforce tenant isolation in every query
export async function getInvoice(invoiceId: string, tenantId: string) {
  const invoice = await prisma.invoice.findFirst({
    where: {
      id: invoiceId,
      tenantId: tenantId, // Strict scope restriction
    },
  })

  if (!invoice) throw new NotFoundError('Invoice not found')
  return invoice
}

2. A02: Cryptographic Failures & Token Hygiene

Common oversights include:

• Storing JWT secrets in client-side bundles or committing them to public git repos.
• Using none or weak HMAC algorithms in token verification.
• Transmitting sensitive auth tokens via URL query parameters (which get logged in proxy caches, CDN logs, and browser histories).

Best Practices:

1. Always store session identifiers in HttpOnly; Secure; SameSite=Strict cookies.
2. Rotate signing keys periodically using asymmetric JWKS endpoints (e.g. RS256 or EdDSA).

3. A10: Server-Side Request Forgery (SSRF)

In applications with image fetching, PDF generators, or webhook dispatchers, SSRF allows attackers to induce the backend server to make unauthorized HTTP requests to internal subnets (e.g., AWS Metadata Endpoint 169.254.169.254).

POST /api/generate-pdf HTTP/1.1
Host: target.app
Content-Type: application/json

{
  "targetUrl": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"
}

Defense-in-Depth Mitigation

1. Validate and whitelist permitted DNS domains and protocols (https only).
2. Resolve DNS IP before request dispatch and block private/loopback CIDRs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
3. Enforce AWS IMDSv2 (session token requirement) on cloud instances.

Need Your Architecture Audited?

Kuro Solutions provides deep-dive black-box, grey-box, and white-box penetration testing with comprehensive executive and technical remediation reports. Request a Security Audit.