owasp-top10-2025

The 2025 list adds Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10) as new categories. Security Misconfiguration rose from #5 to #2, and SSRF moved under Broken Access Control (A01).

The payloads cheatsheet lists vulnerable parameters, HTTP request examples, and filter bypass techniques for SQLi and XSS. It covers inline comment bypasses, CHAR() encoding, alternative HTML event handlers, and WAF polymorphism methods.

The skill includes a SAST/DAST/SCA effectiveness matrix per category. For example, injection flaws are well covered by Semgrep, sqlmap, and Burp Suite, while supply chain failures require SCA tools like Snyk or OWASP Dependency-Check.

Yes, SSRF is covered under A01:2025 Broken Access Control. The cheatsheet includes localhost filter bypasses using decimal and octal IP formats, cloud metadata endpoints for AWS and GCP, and non-HTTP protocol schemes like gopher and dict.

The reference documents platform-specific bypasses for Cloudflare, ModSecurity, AWS WAF, and Akamai, plus encoding methods like Unicode normalization, HTTP parameter pollution, and request smuggling. Each technique includes blue team mitigation guidance.

Automated tools are weak for A06 Insecure Design, which requires threat modeling methods like STRIDE or LINDDUN instead. Logging failures and integrity failures also need manual review of SIEM configuration and deserialization controls.