← Return to Ledger
MODULE_05 // BOUNDARY ASSESSMENT

OWASP Top 10 & Threat Modeling

OPERATIONAL OBJECTIVE

This module is engineered to be brief by design. You do not need comprehensive mastery over each vector yet — your immediate goal is to calibrate the topographical map before venturing deep into active territory. Chapters 7 through 11 dismantle the highest-yield categories line-by-line.

You'll also walk out knowing how to think like an attacker before you ever touch Burp — that's what "threat modeling" in the title means, and it's a separate skill from memorizing a list.

The Vulnerability Landscape: Where the List Comes From

OWASP doesn't invent this list from opinion. Every few years (most recently 2021, with a 2025 release in progress) the foundation pulls vulnerability data from dozens of partner organizations and AppSec tooling vendors, covering hundreds of thousands of real applications, then maps the findings against CWE (Common Weakness Enumeration) categories. The ranking blends two signals: how often a weakness shows up in the wild, and how severe it tends to be when it does. That's why "Broken Access Control" sits at #1 — not because it's the flashiest bug, but because it's both common and consistently damaging.

Bug bounty triage frameworks — Bugcrowd's VRT and HackerOne's severity guidance among them — lean heavily on this same taxonomy when assigning payout tiers, which is exactly why this list matters to your wallet and not just your résumé.

⚠ Calibration Note

One thing the OWASP rank does not tell you: what any single bug is worth in a specific program. A misconfigured S3 bucket (A05) leaking customer PII can outpay a textbook IDOR (A01) if the impact is bigger. Category tells you where to look first. Impact + exploitability + program scope is what actually sets the bounty. Treat the table below as a prevalence map, not a price tag.

📊 Tactical Relevance Matrix

Filter the framework vectors to highlight where hunters spend most of their time:

Rank Security Category Core Operational Meaning Hunter Relevance
A01 Broken Access Control System fails to validate permissions. Covers IDOR and vertical/horizontal privilege escalation. Highest
A02 Cryptographic Failures Weak encryption protocols, cleartext storage, or fragile hashing algorithms. Medium
A03 Injection Untrusted input parsed as code or commands by the backend (SQLi, command injection, XSS's core mechanism). Highest
A04 Insecure Design Flawed architecture or business logic baked in before a single line of code was written. Medium
A05 Security Misconfiguration Default credentials, verbose debug errors, open ports, or exposed admin/asset panels. High
A06 Vulnerable & Outdated Components Running unpatched third-party packages or libraries with active, documented CVEs. High
A07 Identification & Auth Failures Weak verification flows, session token hijacking, or broken account-recovery logic. High
A08 Software & Data Integrity Failures Trusting unsigned updates or unsafely deserializing attacker-controlled data. Lower
A09 Security Logging & Monitoring Failures Insufficient audit trails let malicious activity persist undetected. Rarely Bountied
A10 Server-Side Request Forgery (SSRF) Tricking a backend server into issuing outbound requests on your behalf — often reaching internal-only systems. Highest

The Critical Structural Pattern to Notice

Look at the triage breakdown again. Broken Access Control, Injection, Auth Failures, and SSRF sit at the top of hunter relevance. That's not a coincidence — these four defect families produce the overwhelming majority of critical-severity, easily-verified bugs a hunter finds in their first year. They're also exactly the categories Chapters 7 through 11 are built around.

Logging gaps and supply-chain integrity issues are real institutional risks — the kind a security team genuinely worries about — but they rarely produce a clean, independently provable exploit chain for someone hunting solo. Spend your early energy on input handling and authorization boundaries; that's where the proof-of-concept is fastest to build and the report is easiest to validate.

UNTRUSTED ZONE SEMI-TRUSTED ZONE TRUSTED ZONE Client / Browser attacker-controlled App Server validates & authorizes Database A03 target Internal APIs A10 target HTTP request every input here = hostile authz checks belong here
FIG 5.1 — Trust boundaries: the line your target crosses between zones is where the bug usually lives

A Mental Model: Threat Modeling in Two Minutes

Before you fuzz a single parameter, professional testers ask four questions about a system. This is a stripped-down version of Microsoft's STRIDE model — you don't need to memorize the acronym, but the questions behind it will become second nature by the time you reach Chapter 12 (Recon Methodology).

S — SPOOFING "Can I pretend to be someone else?"

Forged tokens, predictable session IDs, missing signature checks. Feeds directly into Chapter 3 (JWTs) and Chapter 10 (auth bugs).

T — TAMPERING "Can I modify data I shouldn't touch?"

Editing hidden fields, price parameters, or request bodies the client never expected a user to alter.

R — REPUDIATION "Can I do this and leave no trace?"

Maps to A09 — weak logging means an action can't be proven to have happened, which matters more to blue teams than bounty hunters.

I — INFO DISCLOSURE "Can I see data I'm not supposed to?"

Verbose errors, exposed debug endpoints, IDOR responses leaking other users' records.

D — DENIAL OF SERVICE "Can I make this stop working?"

Rarely in scope for bounty programs, but still part of how a real threat model gets built.

E — ELEVATION OF PRIVILEGE "Can I become an admin?"

The end-state of most A01 chains — start as a normal user, end as someone with more power than they granted you.

In practice, your day-to-day threat modeling will be much simpler than the full STRIDE checklist: every time you see an input field, a URL parameter, or an API call, ask "what trust boundary does this cross, and did the server actually check who's asking?" That single question, repeated relentlessly, is most of what separates a hunter who finds bugs from one who just clicks around.

Where Each Category Gets Its Own Chapter

This module is the map. Here's exactly where you'll get hands-on with each high-priority category:

A01 · Broken Access Control Chapter 9 — IDOR & Access Control
A03 · Injection (XSS) Chapter 7 — XSS (theory + labs + DVWA)
A03 · Injection (SQLi) Chapter 8 — SQL Injection (theory + labs + sqlmap)
A07 · Auth/Session Failures Chapter 10 — CSRF & Authentication Bugs
A10 · SSRF Chapter 11 — SSRF & Business Logic
A02, A05, A06 · Crypto, Misconfig, Components Woven into Chapter 12 — Recon Methodology (these are mostly found, not crafted)

Chapter 5 Milestone Checklist (0 / 4 Complete)

Theoretical Foundations
Cognitive Reflection Drills
Understanding Check Queries
Verification Quest 01: Broken Access Control Definition

Can you explain in one sentence what Broken Access Control means in a production environment?

Verification Quest 02: Injection Core Principle

What's the one mechanical difference between an Injection bug and a logic/business-rule bug?

Verification Quest 03: Trust Boundaries

Looking at Figure 5.1 — name one point in a typical login flow where a trust boundary is crossed, and what check should happen exactly there.

Active Recall: High-Value Mapping Drill

⚡ Core Recall Sandbox

Click a high-value vulnerability category on the left, then select its matching exploitation concept on the right:

High-Value Categories
Broken Access Control (A01)
Injection (A03)
Auth/Session Failures (A07)
SSRF (A10)
Real-World Exploit Patterns
Passing payloads the backend interprets directly as code (SQLi, XSS).
Forcing an internal server to query cloud metadata or internal-only hosts on your behalf.
Exploiting IDOR vectors or escalating privileges between accounts/tenants.
Hijacking weak password-reset flows or forging/manipulating JWT tokens.