Guides

Security guides, checklists, and standards — explained.

Practical, accurate how-tos for testing and securing web apps and APIs, plus the OWASP standards explained — all cross-linked to the vulnerabilities and concepts they cover.

Testing how-tos

How to Test for IDOR (Broken Object Level Authorization)How-to
A step-by-step method for finding Insecure Direct Object Reference (IDOR / BOLA) flaws in web apps and APIs using two accounts.
How to Prevent SSRF (Server-Side Request Forgery)How-to
Concrete controls to prevent Server-Side Request Forgery, including DNS-rebinding-safe validation and cloud metadata hardening.
JWT Security Best PracticesHow-to
How to validate and configure JSON Web Tokens correctly to prevent forgery, algorithm confusion, and token abuse.

Checklists

API Penetration Testing ChecklistChecklist
A practical checklist for testing REST and GraphQL APIs, mapped to the OWASP API Security Top 10.
Web Application Security Testing ChecklistChecklist
A structured checklist for testing web applications, aligned to the OWASP Top 10 and organized by area.

Standards explained

OWASP Top 10 (2021) ExplainedExplainer
A concise explanation of each OWASP Top 10 (2021) category, with links to the underlying vulnerabilities.
OWASP API Security Top 10 (2023) ExplainedExplainer
Each OWASP API Security Top 10 (2023) risk explained, with a focus on the authorization flaws that dominate API breaches.
Continuous Penetration Testing: A Practical GuideExplainer
What continuous penetration testing is, why point-in-time testing falls short, and how to adopt it.