ANÁLISE DE VULNERABILIDADES DO OWASP TOP 10 RELACIONADAS AO CWE PARA CODIFICAÇÃO SEGURA DE APLICAÇÕES WEB.

Abstract

The consolidation of web applications and the complexity of modern systems have made information security a critical requirement. Vulnerabilities in source code are one of the main entry points for cyberattacks, since applications are frequently launched with software flaws that result in exploitable security vulnerabilities. The persistence of known flaws highlights a gap between security knowledge and development practice. Therefore, this work aims to demonstrate how the main software flaws impact the security of web applications, establishing a relationship with the first four vulnerability categories of the OWASP Top 10. To this end, static (SAST) and dynamic (DAST) analysis tools were used, adopting a hybrid approach to improve results, reduce false positives, and validate the identified vulnerabilities present in the environment provided by OWASP, Juice Shop. Finally, this work aims to raise awareness about how these flaws can be exploited by malicious users and to reinforce the importance of secure coding as an integral part of the daily lives of developers or those involved in the software lifecycle.