OWASP Top 10 (2021): A Walk-through for Engineers
The 2021 revision of the OWASP Top 10 was the biggest shake-up in nearly a decade. Broken Access Control moved from fifth to first, three new categories appeared (Insecure Design, Software and Data Integrity Failures, Server-Side Request Forgery), and the entire list was reorganized around root causes rather than symptoms. This post walks through each item and what testing it involves.
Web applications · By Thimmagurudu Bathini · Published · 8 min read · Last reviewed
A01 Broken Access Control
Updated November 2026: OWASP has since published the Top 10:2025, which is now the current edition. This article explains the 2021 list, which many existing reports still use; for the newer list, see OWASP Top 10:2025: what changed and what to test.
Now the top risk category, covering everything from missing function-level checks to IDOR to URL tampering. Our manual testers prove these by authenticating as a low-privilege user and walking the application's verb/object matrix — every endpoint, every HTTP method, every object reference. Tools alone miss most of these because the auth bypass usually requires understanding the business context.
A02 Cryptographic Failures
Renamed from Sensitive Data Exposure. We look at data at rest (encryption keys in source, weak KDFs), data in transit (TLS configuration, mixed content), and crypto primitives (ECB mode, predictable IVs, hardcoded secrets in mobile binaries).
A03 Injection
SQLi, NoSQLi, OS command, LDAP and template injection collapsed into one category. XSS is now here too. Manual testing surfaces second-order injection and stored payloads that scanners can rarely detect.
A04 Insecure Design
New for 2021 — and the hardest to test for, because the bug is in the threat model, not the code. We catch these via misuse-case mapping: what was the developer's assumption, and what happens when an adversary violates it.
A05–A10
Security Misconfiguration, Vulnerable Components, Identification & Auth Failures, Software/Data Integrity, Logging Failures, and SSRF.
The VAPT methodology page describes how a test runs, and web application penetration testing describes what a web test covers.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana