The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
The OWASP Top 10 explained category by category, with real examples: broken access control, injections, SSRF, cryptographic failures and more. With links to the theory and hands-on labs for each flaw.
Gorka El Bochi
Founder of BBLABS
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
Quick answer: The OWASP Top 10 is the reference list of the 10 most critical web security risk categories, maintained by the OWASP foundation. The current official version is the 2021 one (with a 2025 release candidate in progress). It's not a list of isolated vulnerabilities, but of risk families that every hunter and developer should master.
The OWASP Top 10 is an awareness document published by the Open Worldwide Application Security Project (OWASP) every few years. Based on real data from thousands of applications, it summarizes the ten most serious and frequent risk categories in web security.
It matters for two reasons:
The stable version cited in most programs is the 2021 one. OWASP published a release candidate of the next edition in 2025; the final structure may change, so here I explain the 2021 list (the official one) and note at the end where 2025 is heading.
It moved to number 1 in 2021: it was the category with the highest incidence of all. It happens when a user can do or see things they shouldn't: read another account's data, access admin functions or bypass restrictions.
Real example: you change /api/orders/123 to /api/orders/124 and see another customer's order (and address). That's an IDOR, the most common case of this family.
Dig deeper in Broken Access Control and IDOR; the practical theory is in Academy · IDOR & Broken Access Control.
Formerly called "Sensitive Data Exposure". It covers poorly protected sensitive data: traffic without TLS, passwords with weak hashes (MD5/SHA1 without salt), keys in the code, badly implemented encryption.
Real example: an API that returns full card numbers in the JSON response, or a login that travels over plain HTTP on a public network. The attacker doesn't "break" the crypto: they take advantage of the fact that there's almost none.
One of the oldest and most dangerous families. It happens when user data gets mixed into a command or query without being properly separated. In 2021, XSS became part of this category.
It includes several flaws that have their own page:
Real example: a search box that builds the query with "SELECT * FROM users WHERE name = '" + input + "'" allows ' OR '1'='1 to dump the whole table. Practice the pattern in Academy · XSS and Academy · SQLi.
New in 2021. It's not an implementation bug, but a design flaw: nobody thought about abuse from the start. It's not fixed with a single patch; the flow has to be redesigned.
Real example: a transfer process that checks the balance and deducts it in two non-atomic steps lets you spend the money twice by sending requests in parallel. That falls under Race Condition and business logic, which is among the best-paying because scanners don't detect it.
Servers, frameworks or services with insecure default settings: exposed admin panels, verbose error messages, misconfigured CORS, public S3 buckets, listable directories.
Real example: a /.git/ accessible from the browser lets you download the application's entire source code. Or a CORS with a reflected Access-Control-Allow-Origin that allows reading cross-origin data: it's explained in CORS and XXE.
Using libraries, frameworks or dependencies with known vulnerabilities. You don't have to discover the flaw: it already has a CVE; you just have to find where it's still unpatched.
Real example: Log4Shell (CVE-2021-44228), the vulnerability in the Log4j library that in 2021 allowed RCE across half the internet by just sending a string in a text field. Millions of systems affected by an outdated dependency.
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Formerly "Broken Authentication". It covers weak logins: allowing brute force, broken session management, bypassable 2FA, insecure password recovery, poorly validated JWT tokens.
Real example: an OTP verification endpoint with no attempt limit lets you try all 1,000,000 six-digit codes. Or a JWT signed with alg: none that the server accepts. You have the deep dive in Auth Bypass, Academy · Authentication Bypass and Academy · OAuth.
New in 2021. Trusting code, updates or data without verifying their integrity. It includes insecure deserialization and supply chain attacks.
Real example: the SolarWinds attack (2020), where malicious code was inserted into a legitimate software update that was later distributed to thousands of organizations. Blind trust in the source was the flaw.
Not logging security events, or not alerting on them, lets attacks go unnoticed for months. It's rarely a direct bounty, but it amplifies the impact of all the others.
Real example: a company that takes 200 days to notice a breach because nobody was watching the massive failed logins or the anomalous data access.
Added in 2021 by community vote. The attacker gets the server to make requests to destinations of the attacker's choosing: the internal network, non-exposed services or the cloud metadata.
Real example: the Capital One breach (2019). An SSRF allowed reaching the AWS metadata endpoint (169.254.169.254), stealing IAM credentials and accessing the data of more than 100 million customers. It's the textbook example of why SSRF is in the Top 10: dig deeper in SSRF and Academy · SSRF.
| # | Category | Star flaw | Practice |
|---|---|---|---|
| A01 | Broken Access Control | IDOR | /en/vulnerabilidades/idor |
| A02 | Cryptographic Failures | Unencrypted data | — |
| A03 | Injection | SQLi, XSS | /en/vulnerabilidades/sqli |
| A04 | Insecure Design | Business logic | /en/vulnerabilidades/business-logic |
| A05 | Security Misconfiguration | CORS, public S3 | /en/vulnerabilidades/cors |
| A06 | Vulnerable components | Log4Shell | — |
| A07 | Auth Failures | JWT, OTP | /en/vulnerabilidades/auth-bypass |
| A08 | Data integrity | Deserialization | /en/vulnerabilidades/ssti |
| A09 | Logging & Monitoring | Missing logs | — |
| A10 | SSRF | Cloud metadata | /en/vulnerabilidades/ssrf |
OWASP published a release candidate of the next edition in 2025. Like any revision, it's based on more recent data and a community survey, and the final list may differ from the draft. The general direction points to giving more weight to the software supply chain (the risk that A08 already started to capture in 2021) and to reorganizing some injection and configuration categories.
Practical tip: don't memorize the exact number of each category. What really matters is understanding the flaw families and being able to recognize them in a real application. When the final 2025 version comes out, the concepts will be the same; only the order and labels will change.
Is the OWASP Top 10 a list of vulnerabilities?
Not exactly. They're risk categories. Within "Injection" fit SQLi, XSS, command injection, etc. It's a map of families, not a catalog of CVEs.
Do I have to memorize all 10 to do bug bounty?
Not by heart, but you do need to understand them. They give you a common vocabulary with security teams and orient you on where to look first.
Which category pays most?
The ones that touch money, data or code execution: Broken Access Control (A01), Injection (A03) and SSRF (A10) account for many of the best-paid reports.
Where do I practice all this?
In the BBLABS labs you reproduce real flaws from each family, in order with the roadmap. The category-by-category theory is in the vulnerability dictionary.
The OWASP Top 10 is the best starting point for ordering your thoughts: instead of a thousand isolated flaws, ten families that cover the vast majority of what you'll encounter. Master access control, injection and SSRF above all (they're the most frequent and the best paid), lean on the theory in the vulnerability dictionary and turn it into a reflex by practicing labs based on real cases.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
Learn to identify and exploit IDOR (Insecure Direct Object Reference) vulnerabilities in web applications. From the basics to writing effective reports.
What bug bounty is, how a program works step by step, which platforms it runs on (HackerOne, Bugcrowd, Intigriti, YesWeHack), how much you earn, whether it's legal and where to start from scratch.
What bug bounty really pays: average rewards by vulnerability type and severity, what top hunters earn, the reality for beginners and why most people don't make a living from it.