CRV2 FrameworkSpecIssuesASPTop10

Using OWASP TOP 10 as your guideline

The OWASP TOP 10 is a detailed list of the highest security risks web application faces. It help us identify the most critical security threats facing organizations. Performing a Code review efficiently requires using a model or framework that help us identify these issues quickly. Consequently, OWASP TOP 10 is one of these guides that provides us with the necessary information to implement proper Code Review.

Applying OWASP TOP 10 to ASP.NET code review

The following table contains OWASP TOP 10 - 2013 guideline and how you can apply this during your code review

OWASP TOP 10 risk	Description	What to look for in the code
A1 Injection	Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.	SQL queries are parameterized and that any input used in a SQL query is validated. Look for implementation of Parameter collections If using Stored procedures that GRANT proper permissions and avoids using unfiltered content from user If using LDAP services , check that clear text passwords and authentication is not used in the code
A2 Broken Authentication and Session Management	Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.	No use of encryption to save passwords Clear-text credentials in web.config files Clear connectionstrings without encryption
Example	Example	Example