OWASP Top 10 Coverage

The OWASP Top 10 is the most widely referenced standard for web application security. Shieldome covers all 10 categories with 100+ individual checks.

A01:2021 — Broken Access Control

Checks whether unauthorized users can access restricted resources.

• Sensitive path probing (/admin, /.env, /config, /phpinfo.php, etc.)
• Directory listing detection
• Open redirect via URL parameters
• IDOR pattern detection in API responses

A02:2021 — Cryptographic Failures

Checks whether data is adequately protected in transit.

• HTTPS redirect enforcement
• SSL/TLS certificate validity, expiry, and chain
• Minimum TLS version (TLS 1.2+ required)
• Weak cipher suite detection
• HSTS header presence and max-age value
• CAA DNS record presence

A03:2021 — Injection

Checks whether user input is handled safely in queries and interpreters.

• SQL Injection — error-based and time-based blind detection
• XSS reflection — payloads reflected back unescaped
• Stored XSS — probe persisted and re-displayed
• DOM XSS — dangerous sink patterns in JavaScript
• Path Traversal — ../ sequences in URL parameters
• SSTI — template expression evaluation detection
• CRLF Injection — header injection via \r\n in parameters
• NoSQL Injection — operator injection indicators

A04:2021 — Insecure Design

Checks for common design-level security oversights.

• robots.txt analysis for sensitive path leakage
• Backup file detection (.bak, .old, .zip, .sql)
• Source map exposure (.js.map files)
• Git repository exposure (/.git/config)
• API specification exposure (/openapi.json, /swagger.json)

A05:2021 — Security Misconfiguration

Checks whether security settings are correctly configured.

• Security header audit (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• Detailed CSP analysis (unsafe-inline, unsafe-eval, wildcards)
• Server version disclosure in headers
• CORS misconfiguration (wildcard, credential leakage)
• Debug mode detection (verbose error pages)
• HTTP method permissiveness (TRACE, PUT, DELETE)
• WAF detection
• GraphQL introspection exposure
• WebSocket security
• Rate limiting presence

A06:2021 — Vulnerable and Outdated Components

Checks whether detectable software versions have known vulnerabilities.

• Framework and CMS version detection from headers and HTML
• Technology fingerprinting (favicon hash, JS libraries)
• Software Composition Analysis (SCA) from package.json, requirements.txt
• CVE matching against detected component versions
• Email security records (SPF, DMARC, DKIM)

A07:2021 — Identification and Authentication Failures

Checks whether authentication mechanisms are secure.

• Cookie security flags (HttpOnly, Secure, SameSite)
• Deep cookie analysis (name patterns, scope)
• JWT exposure in responses and headers
• JWT algorithm and secret weakness checks
• OAuth/OIDC configuration analysis
• Login page security assessment
• Session token patterns in URLs

A08:2021 — Software and Data Integrity Failures

Checks whether external resources are integrity-protected.

• Subresource Integrity (SRI) on <script> and <link> tags
• HTTP Request Smuggling indicators (CL.TE, TE.CL)
• Prototype pollution patterns in JavaScript

A09:2021 — Security Logging and Monitoring Failures

Checks whether sensitive information leaks through error responses.

• Verbose error page detection
• Stack trace exposure in responses
• Internal path disclosure in error messages

A10:2021 — Server-Side Request Forgery (SSRF)

Checks whether the server can be induced to make requests to internal resources.

• URL parameter analysis for SSRF-prone patterns (url=, redirect=, fetch=, etc.)
• Internal IP reference detection in responses
• Cloud metadata endpoint reference checks