Pick a track and a year to see how OWASP's Top 10 has evolved — and which real-world attack techniques fall under each category. Categories, names, and years are sourced directly from OWASP; descriptions and technique examples are written for this site.
Restrictions on what authenticated users can do aren't properly enforced server-side.
📌 Stays #1, and now absorbs SSRF (2021's A10), reflecting that SSRF is fundamentally an access-control failure.
Attack techniques in this category
Drag to rotate. Pick Web, API, Mobile, or Smart Contract, then click a node to see which real MITRE ATT&CK techniques (TTPs) are actually connected to that category — every link here is derived from the same mapping data used elsewhere on this page, not invented separately.
Drag to rotate
Click a node to see its real, mapped MITRE ATT&CK techniques (TTPs).
Every enterprise tactic and technique, pulled directly from MITRE's own public data. Techniques with a green marker link straight to a write-up, code example, or doc elsewhere on this site — everything else links out to attack.mitre.org.
Loading the ATT&CK matrix…