Lesson 1.12: The OWASP Top 10, and what attacks look like in a log
OWASP and its Top 10, the shared list of the most important web application risks, as a map for this course. URL encoding, and how automated scanners and attack tools show up in a web server's access log. In the lab you read the shop's log, count status codes, pick out attempts at SQL injection, path traversal and cross-site scripting, probes for exposed files, and the address and tools behind them, and check which attempts got a worrying answer.
18 min
You will learn to
- Explain what OWASP and the OWASP Top 10 are
- Decode URL-encoded input
- Read an access log line field by field
- Recognise common attack patterns in a log
- Tell noise from attempts that got a worrying response
Key terms
- OWASP
- The Open Worldwide Application Security Project, a non-profit community that publishes free guides, tools and standards for application security.
- OWASP Top 10
- A regularly updated list of the ten most critical web application security risks, used worldwide as a shared vocabulary.
- URL encoding
- Writing special characters in a URL as % followed by two hex digits.
- Access log
- The web server's record of every request: client address, time, request line, status code, size, referrer and user agent.
- Vulnerability scanner
- A tool that sends many crafted requests to find weaknesses automatically.
← Network devices: network cards, switches, routers and access points · All lessons · Assets, threats, vulnerabilities and risk →