This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
OWASP Common Numbering Project
Home
Common OWASP Numbering
An exciting development, a new numbering scheme that will be common across OWASP Guides and References has been developed. The numbering is based on the OWASP ASVS section and detailed requirement numbering. The effort to develop the numbering was a team effort, led by Mike Boberski (ASVS project lead and co-author). OWASP Top Ten, Guide, and Reference project leads and contributors as well as the OWASP leadership worked together to develop numbering that would allow for easy mapping between OWASP Guides and References, and that would allow for a period of transition as Guides and References are updated to reflect the new numbering. This project will track retired numbers and provide a centralized clearinghouse for mapping information. For more information, please contact Mike or Brad. |
Latest News
|
FAQ
Start Here
Coming soon!
Let's Talk Here
Coming soon!
Related Resources
Coming soon!
Common OWASP Numbering
Common OWASP Numbering
OWASP-0600 OWASP-0600-DEPRECATED OWASP-0604 OWASP-0604-DEPRECATED OWASP-0604-DG OWASP-0604-DG-01 OWASP-0604-TG OWASP-0604-TG-DV-005 OWASP-0604-TG-DV-005-DEPRECATED 0123456789012345678901234567890123456789 1 2 3 |
Reference
|
Legacy Mappings
Coming soon! Mappings to e.g. Testing Guide.
Mapping to Legacy Testing Guide IDs
|
|
|
Information Gathering | ||
OWASP-IG-001 | Spiders, Robots and Crawlers | OWASP-<put mapped ASVS 4 digit # here>-TG-IG-001 |
OWASP-IG-002 | Search Engine Discovery/Reconnaissance | |
OWASP-IG-003 | Identify application entry points | |
OWASP-IG-004 | Testing for Web Application Fingerprint | |
OWASP-IG-005 | Application Discovery | |
OWASP-IG-006 | Analysis of Error Codes | |
Configuration Management Testing | ||
OWASP-CM-001 | SSL/TLS Testing (SSL Version, Algorithms, Key length, Digital Cert. Validity) | |
OWASP-CM-002 | DB Listener Testing | |
OWASP-CM-003 | Infrastructure Configuration Management Testing | |
OWASP-CM-004 | Application Configuration Management Testing | |
OWASP-CM-005 | Testing for File Extensions Handling | |
OWASP-CM-006 | Old, backup and unreferenced files | |
OWASP-CM-007 | Infrastructure and Application Admin Interfaces | |
OWASP-CM-008 | Testing for HTTP Methods and XST | |
Authentication Testing | ||
OWASP-AT-001 | Credentials transport over an encrypted channel | |
OWASP-AT-002 | Testing for user enumeration | |
OWASP-AT-003 | Testing for Guessable (Dictionary) User Account | |
OWASP-AT-004 | Brute Force Testing | |
OWASP-AT-005 | Testing for bypassing authentication schema | |
OWASP-AT-006 | Testing for vulnerable remember password and pwd reset | |
OWASP-AT-007 | Testing for Logout and Browser Cache Management | |
OWASP-AT-008 | Testing for CAPTCHA | |
OWASP-AT-009 | Testing Multiple Factors Authentication | |
OWASP-AT-010 | Testing for Race Conditions | |
Session Management | ||
OWASP-SM-001 | Testing for Session Management Schema | |
OWASP-SM-002 | Testing for Cookies attributes | |
OWASP-SM-003 | Testing for Session Fixation | |
OWASP-SM-004 | Testing for Exposed Session Variables | |
OWASP-SM-005 | Testing for CSRF | |
Authorization Testing | ||
OWASP-AZ-001 | Testing for Path Traversal | |
OWASP-AZ-002 | Testing for bypassing authorization schema | |
OWASP-AZ-003 | Testing for Privilege Escalation | |
Business logic testing | ||
OWASP-BL-001 | Testing for business logic | |
Data Validation Testing | ||
OWASP-DV-001 | Testing for Reflected Cross Site Scripting | |
OWASP-DV-002 | Testing for Stored Cross Site Scripting | |
OWASP-DV-003 | Testing for DOM based Cross Site Scripting | |
OWASP-DV-004 | Testing for Cross Site Flashing | |
OWASP-DV-005 | SQL Injection | |
OWASP-DV-006 | LDAP Injection | |
OWASP-DV-007 | ORM Injection | |
OWASP-DV-008 | XML Injection | |
OWASP-DV-009 | SSI Injection | |
OWASP-DV-010 | XPath Injection | |
OWASP-DV-011 | IMAP/SMTP Injection | |
OWASP-DV-012 | Code Injection | |
OWASP-DV-013 | OS Commanding | |
OWASP-DV-014 | Buffer overflow | |
OWASP-DV-015 | Incubated vulnerability Testing | |
OWASP-DV-016 | Testing for HTTP Splitting/Smuggling | |
Denial of Service Testing | ||
OWASP-DS-001 | Testing for SQL Wildcard Attacks | |
OWASP-DS-002 | Locking Customer Accounts | |
OWASP-DS-003 | Testing for DoS Buffer Overflows | |
OWASP-DS-004 | User Specified Object Allocation | |
OWASP-DS-005 | User Input as a Loop Counter | |
OWASP-DS-006 | Writing User Provided Data to Disk | |
OWASP-DS-007 | Failure to Release Resources | |
OWASP-DS-008 | Storing too Much Data in Session | |
Web Services Testing | ||
OWASP-WS-001 | WS Information Gathering | |
OWASP-WS-002 | Testing WSDL | |
OWASP-WS-003 | XML Structural Testing | |
OWASP-WS-004 | XML content-level Testing | |
OWASP-WS-005 | HTTP GET parameters/REST Testing | |
OWASP-WS-006 | Naughty SOAP attachments | |
OWASP-WS-007 | Replay Testing | |
AJAX Testing | ||
OWASP-AJ-001 | AJAX Vulnerabilities | |
OWASP-AJ-002 | AJAX Testing |
Mapping to Top 10 2010 IDs
|
|
|
A1 | Injection |
<check that all of these are mapped to ASVS identifiers, not TG> OWASP-0705 OWASP-0706 OWASP-0707 OWASP-0708 OWASP-0709 OWASP-0710 OWASP-0711 OWASP-0712 |
A2 | Cross Site Scripting | OWASP-0701
OWASP-0702 OWASP-0703 OWASP-0704 |
A3 | Broken Authentication and Session Management | OWASP-0300
OWASP-0400 |
A4 | Insecure Direct Object References | OWASP-0502 |
A5 | Cross Site Request Forgery | OWASP-0405 |
A6 | Security Misconfiguration | OWASP-0203
OWASP-0204 |
A7 | Failure to Restrict URL Access | OWASP-0500 |
A8 | Unvalidated Redirects and Forwards | OWASP-0717 |
A9 | Insecure Cryptographic Storage | OWASP-0209 |
A10 | Insufficient Transport Layer Protection | OWASP-0201 |
Other mappings
Coming soon! Mappings to e.g. WASC.
Retired numbers
Coming soon! Organized by Guide.
News
Coming soon!
Contributors
Project Leader
Project Contributors
|
Project Sponsorship |