C4:2018-Encode andEscape DataC5:2018-ValidateAll InputsA9:2013-UsingComponentswith KnownVulnerabilitiesA6:2017-SecurityMisconfigurationA1:2013-InjectionC9:2018-ImplementSecurityLogging andMonitoringC10:2018-Handle allErrors andExceptionsA8:2013-Cross-SiteRequestForgery(CSRF)A7:2013-MissingFunctionLevel AccessControlC3:2018-SecureDatabaseAccessA1:2017-InjectionA10:2017-InsufficientLogging &MonitoringC8:2018-ProtectDataEverywhereA2:2017-BrokenAuthenticationA5:2013-SecurityMisconfigurationC2:2018-LeverageSecurityFrameworksand LibrariesA7:2017-Cross-SiteScripting(XSS)C7:2018-EnforceAccessControlsA6:2013-SensitiveDataExposureA8:2017-InsecureDeserializationA9:2017-UsingComponentswith KnownVulnerabilitiesC1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlC6:2018-ImplementDigitalIdentityA4:2013-InsecureDirect ObjectReferencesA3:2013-Cross-SiteScripting(XSS)A2:2013-BrokenAuthenticationand SessionManagementA3:2017-SensitiveDataExposureA10:2013-UnvalidatedRedirectsandForwardsA4:2017-XMLExternalEntities(XXE)C4:2018-Encode andEscape DataC5:2018-ValidateAll InputsA9:2013-UsingComponentswith KnownVulnerabilitiesA6:2017-SecurityMisconfigurationA1:2013-InjectionC9:2018-ImplementSecurityLogging andMonitoringC10:2018-Handle allErrors andExceptionsA8:2013-Cross-SiteRequestForgery(CSRF)A7:2013-MissingFunctionLevel AccessControlC3:2018-SecureDatabaseAccessA1:2017-InjectionA10:2017-InsufficientLogging &MonitoringC8:2018-ProtectDataEverywhereA2:2017-BrokenAuthenticationA5:2013-SecurityMisconfigurationC2:2018-LeverageSecurityFrameworksand LibrariesA7:2017-Cross-SiteScripting(XSS)C7:2018-EnforceAccessControlsA6:2013-SensitiveDataExposureA8:2017-InsecureDeserializationA9:2017-UsingComponentswith KnownVulnerabilitiesC1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlC6:2018-ImplementDigitalIdentityA4:2013-InsecureDirect ObjectReferencesA3:2013-Cross-SiteScripting(XSS)A2:2013-BrokenAuthenticationand SessionManagementA3:2017-SensitiveDataExposureA10:2013-UnvalidatedRedirectsandForwardsA4:2017-XMLExternalEntities(XXE)

Stash OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
  1. C4:2018-Encode and Escape Data
  2. C5:2018-Validate All Inputs
  3. A9:2013-Using Components with Known Vulnerabilities
  4. A6:2017-Security Misconfiguration
  5. A1:2013-Injection
  6. C9:2018-Implement Security Logging and Monitoring
  7. C10:2018-Handle all Errors and Exceptions
  8. A8:2013-Cross-Site Request Forgery (CSRF)
  9. A7:2013-Missing Function Level Access Control
  10. C3:2018-Secure Database Access
  11. A1:2017-Injection
  12. A10:2017-Insufficient Logging & Monitoring
  13. C8:2018-Protect Data Everywhere
  14. A2:2017-Broken Authentication
  15. A5:2013-Security Misconfiguration
  16. C2:2018-Leverage Security Frameworks and Libraries
  17. A7:2017-Cross-Site Scripting (XSS)
  18. C7:2018-Enforce Access Controls
  19. A6:2013-Sensitive Data Exposure
  20. A8:2017-Insecure Deserialization
  21. A9:2017-Using Components with Known Vulnerabilities
  22. C1:2018-Define Security Requirements
  23. A5:2017-Broken Access Control
  24. C6:2018-Implement Digital Identity
  25. A4:2013-Insecure Direct Object References
  26. A3:2013-Cross-Site Scripting (XSS)
  27. A2:2013-Broken Authentication and Session Management
  28. A3:2017-Sensitive Data Exposure
  29. A10:2013-Unvalidated Redirects and Forwards
  30. A4:2017-XML External Entities (XXE)