GUIDE
OWASP Top 10 Reporting Guide for Pentesters
The OWASP Top 10 is the most widely referenced standard for web application security risks. This guide shows you how to map your penetration testing findings to OWASP categories, with real examples, severity guidelines, and remediation for each category.
Why Map Findings to OWASP Top 10?
- Compliance requirements — PCI-DSS, SOC 2, and many frameworks reference OWASP Top 10
- Executive communication — stakeholders recognize OWASP categories as industry standards
- Remediation prioritization — OWASP ranking reflects real-world exploitation frequency
- Consistency — standardized categories across different pentesters and engagements
A01: Broken Access Control
Typical Severity: Critical to High
Restrictions on authenticated users are not properly enforced. Attackers can exploit flaws to access unauthorized functionality or data.
Common Findings in This Category:
Remediation Guidance:
Implement server-side access control checks on every request. Use deny-by-default. Disable directory listing. Invalidate JWT tokens on server side. Log access control failures and alert on repeated attempts.
A02: Cryptographic Failures
Typical Severity: High to Critical
Failures related to cryptography that lead to exposure of sensitive data. Previously known as 'Sensitive Data Exposure'.
Common Findings in This Category:
Remediation Guidance:
Encrypt all sensitive data in transit (TLS 1.2+) and at rest. Use strong algorithms (AES-256, bcrypt/argon2 for passwords). Never hardcode secrets. Implement proper key management.
A03: Injection
Typical Severity: Critical
User-supplied data is sent to an interpreter as part of a command or query. Includes SQL, NoSQL, OS command, LDAP, and XPath injection.
Common Findings in This Category:
Remediation Guidance:
Use parameterized queries and prepared statements. Validate and sanitize all user input. Use ORMs with proper escaping. Implement WAF rules as defense-in-depth. Apply least privilege to database accounts.
A04: Insecure Design
Typical Severity: Medium to High
Flaws in the design and architecture of the application, not just implementation bugs. Missing or ineffective security controls.
Common Findings in This Category:
Remediation Guidance:
Use threat modeling during design. Implement secure design patterns. Add rate limiting and account lockout. Use CAPTCHA for sensitive operations. Follow the principle of least privilege throughout.
A05: Security Misconfiguration
Typical Severity: Medium to High
Insecure default configurations, incomplete configurations, open cloud storage, misconfigured HTTP headers, or verbose error messages.
Common Findings in This Category:
Remediation Guidance:
Implement a repeatable hardening process. Remove default accounts. Disable directory listing and verbose errors. Configure security headers. Automate configuration verification in CI/CD.
A06: Vulnerable and Outdated Components
Typical Severity: Varies (depends on the specific CVE)
Using components (libraries, frameworks, software) with known vulnerabilities or that are no longer supported.
Common Findings in This Category:
Remediation Guidance:
Maintain an inventory of all components and versions. Subscribe to security advisories. Automate dependency scanning in CI/CD. Remove unused dependencies. Only use components from official sources.
A07: Identification and Authentication Failures
Typical Severity: High
Weaknesses in authentication mechanisms that allow attackers to assume other users' identities.
Common Findings in This Category:
Remediation Guidance:
Implement MFA wherever possible. Enforce strong password policies. Use secure session management. Rate limit authentication attempts. Invalidate sessions on logout and password change.
A08: Software and Data Integrity Failures
Typical Severity: High to Critical
Failures related to code and infrastructure that do not protect against integrity violations. Includes insecure CI/CD pipelines and insecure deserialization.
Common Findings in This Category:
Remediation Guidance:
Use digital signatures to verify software integrity. Implement SRI for CDN resources. Secure CI/CD pipeline with access controls. Avoid insecure deserialization — use safe data formats like JSON.
A09: Security Logging and Monitoring Failures
Typical Severity: Medium
Insufficient logging, detection, monitoring, and active response allows attackers to further attack systems undetected.
Common Findings in This Category:
Remediation Guidance:
Log all authentication events, access control failures, and server-side input validation failures. Ensure logs are sent to centralized log management. Set up alerts for suspicious patterns. Implement an incident response plan.
A10: Server-Side Request Forgery (SSRF)
Typical Severity: High to Critical
SSRF occurs when a web application fetches a remote resource without validating the user-supplied URL, allowing attackers to reach internal services.
Common Findings in This Category:
Remediation Guidance:
Validate and sanitize all user-supplied URLs. Use allowlists for permitted domains. Block requests to private IP ranges. Disable unnecessary URL schemes. Use network segmentation to limit SSRF impact.
Automatic OWASP Classification
Manually mapping every finding to OWASP categories is tedious. PentestReportAI automatically classifies your findings into OWASP Top 10 categories using AI, and generates OWASP-organized reports with a single click.
- Paste raw findings from any source (Nmap, Burp Suite, manual notes)
- AI automatically maps each finding to the relevant OWASP category
- Select the "OWASP Top 10" template for compliance-ready output
- Export as PDF or DOCX with findings grouped by OWASP category
Related guides: How to Write a Pentest Report | CVSS 3.1 Scoring Explained