OWASP Top 10:2025 for Penetration Testers — Quick Reference
A condensed, field-ready reading of the OWASP Top 10:2025 for penetration testers — what to look for in each category during an engagement.
What this reference is
OWASP’s Top 10:2025 is an awareness document naming the ten application security risks the project currently considers most critical — not a testing standard. This page is TMG Security’s own condensed reading of that list, built for use during a penetration test: what each category means for a tester, what to look for, and why it matters. It is not an official OWASP publication and does not replace one.
About this page. The OWASP Top 10 is authored and maintained by OWASP (the Open Worldwide Application Security Project). This is TMG Security’s own condensed, pentester-oriented reading of the OWASP Top 10:2025 — TMG does not claim to have authored the Top 10, and does not claim OWASP’s endorsement or affiliation. Official OWASP material takes precedence over this summary — see References below, and TMG’s full analysis for the complete reasoning behind each entry.
OWASP Top 10:2025 quick reference
Category names and ordering follow the official OWASP Top 10:2025 publication exactly. The “what to look for” and “why it matters” columns are TMG Security’s own condensed testing notes, drawn from TMG’s full analysis of the list — not quotations from OWASP.
| Category | What to look for | Why it matters |
|---|---|---|
| A01 — Broken Access Control | Object-level checks on every verb, not just reads. Endpoints added after the original CRUD surface — exports, admin tooling, integrations. Authorization performed in the client. Internal service calls that trust the network. | It cannot be centralised the way authentication can — every handler has to get it right, and the number of handlers only grows. |
| A02 — Security Misconfiguration | Defaults left in place, verbose errors, permissive CORS, storage and bucket policy, unnecessary features enabled, reachable management interfaces, and staging configured more loosely than production while holding the same data. | Ask whether the configuration was decided or inherited — inherited configuration is where the findings are. |
| A03 — Software Supply Chain Failures | Whether an inventory exists at all. Integrity verification on artefacts. Who can modify a pipeline definition. Where build secrets live. Whether a dependency can execute code at install time. | The pipeline is a production system with production credentials, and it is frequently excluded from the scope of the assessments that cover the application it builds. |
| A04 — Cryptographic Failures | Data classified correctly in the first place; transport configuration and certificate validation, including internal hops; key management and rotation; storage of secrets; password hashing choices. | Not “is it encrypted” but what threat the encryption addresses, and whether the key management actually supports that claim. |
| A05 — Injection | Injection has broadened well past SQL: template engines, expression languages, command construction, LDAP, XML, NoSQL query objects. TMG testing extension: where an engagement includes LLM-backed features, test prompt construction as an injection-adjacent surface. OWASP addresses LLM prompt injection separately in the OWASP LLM Top 10; it is not part of the official A05:2025 scope. | Defensive takeaway: parameterisation where the interpreter supports it, strict allow-lists where it does not, and context-correct encoding at the point of output. |
| A06 — Insecure Design | Missing rate limits on operations with real-world cost. Recovery flows that weaken the authentication they are meant to support. Trust assumptions between services that nothing verifies. Business processes with no enforced sequence. | No amount of correct coding fixes an unsafe design — this category is where threat modelling earns its place. |
| A07 — Authentication Failures | Session lifecycle — fixation, rotation on privilege change, invalidation on logout and password change. Multi-factor coverage including recovery and legacy paths. Credential stuffing resistance. Token handling: expiry, audience, signature verification, and whether the algorithm is pinned. | See TMG’s full analysis for this category’s testing rationale. |
| A08 — Software or Data Integrity Failures | Unsigned updates, deserialisation of untrusted data, CI/CD steps that pull unverified artefacts, and client-side dependencies loaded without integrity checks. | Distinct from A03 — this is about trusting content that was never verified, not about the provenance of the supply chain. |
| A09 — Security Logging & Alerting Failures | Whether security-relevant events are recorded at all; whether they contain the subject, object and action needed to reconstruct a sequence; whether logs are tamper-resistant; and whether anything is actually alerted on. Ask during the test: did anyone see the testing traffic? | This category determines whether the next real incident is discovered internally or reported by a third party. |
| A10 — Mishandling of Exceptional Conditions | Whether failures fail closed or open. Whether an error path skips a downstream check. Whether a timeout mid-transaction leaves an object in an undefined state. Whether error output discloses internals. Whether retries are idempotent. Testing approach: deliberately induce failure. | The happy path is usually well tested; the error path frequently is not. A09 and A10 both tend to be under-tested because neither produces a satisfying proof-of-concept. |
Category names and order verified against the official OWASP Top 10:2025 publication at implementation time. No CWE counts, CVE figures, or other external statistics are included in this reference.
How to use this during a penetration test
Treat each category as a prompt for a line of enquiry rather than a test case. The table above gives a tester’s framing for each: what to look for, and what the defensive takeaway is. Refer to the official OWASP publication for the authoritative definitions and data.
TMG practical testing note: scope
The practical value of the 2025 edition is the reminder that the perimeter of an assessment is usually drawn too tightly. If the pipeline that builds the application and the error paths that run when it fails are both out of scope, two of the categories above cannot be evaluated at all. Use this list to argue for scope. Then test the application properly, which means going well past ten categories.
Limitations and attribution
- OWASP (the Open Worldwide Application Security Project) authors and maintains the OWASP Top 10. TMG Security did not create, govern, or contribute to the OWASP Top 10:2025, and is not affiliated with or endorsed by OWASP.
- This page is TMG Security’s own condensed, pentester-oriented reading of the published OWASP Top 10:2025 categories — it is not an official OWASP publication, and it is not a substitute for one.
- Official OWASP material always takes precedence over this summary. Consult the official OWASP Top 10:2025 project page and its individual category pages for authoritative, current definitions.
- The OWASP Top 10 is an awareness document, not a testing standard or an industry-standard certification. Used as a rigid checklist it produces shallow engagements; used as a map of where risk has concentrated, it is genuinely useful.
- The A05 entry above includes one TMG testing extension (LLM-backed prompt construction), clearly labeled as such — it is not part of the official OWASP A05:2025 scope.
- This reference does not include CWE counts, CVE statistics, survey data, or any severity/likelihood scoring — none of that appears in TMG’s underlying analysis, and none has been added here.
This is TMG Security’s own condensed reference, not an OWASP publication. TMG does not create, govern, or claim authorship of the OWASP Top 10, and is not affiliated with or endorsed by OWASP.
Official OWASP Top 10:2025 material takes precedence over this summary. See References below for the primary sources.
References
At a glance
