A7:2013-MissingFunctionLevel AccessControlA1:2013-InjectionA5:2017-BrokenAccessControlC5:2018-ValidateAll InputsA7:2017-Cross-SiteScripting(XSS)A6:2017-SecurityMisconfigurationC1:2018-DefineSecurityRequirementsC8:2018-ProtectDataEverywhereC10:2018-Handle allErrors andExceptionsA10:2013-UnvalidatedRedirectsandForwardsC4:2018-Encode andEscape DataA4:2013-InsecureDirect ObjectReferencesA8:2017-InsecureDeserializationA5:2013-SecurityMisconfigurationC2:2018-LeverageSecurityFrameworksand LibrariesC9:2018-ImplementSecurityLogging andMonitoringA6:2013-SensitiveDataExposureA2:2017-BrokenAuthenticationA8:2013-Cross-SiteRequestForgery(CSRF)A10:2017-InsufficientLogging &MonitoringC7:2018-EnforceAccessControlsA1:2017-InjectionA2:2013-BrokenAuthenticationand SessionManagementA3:2017-SensitiveDataExposureC6:2018-ImplementDigitalIdentityA9:2017-UsingComponentswith KnownVulnerabilitiesC3:2018-SecureDatabaseAccessA3:2013-Cross-SiteScripting(XSS)A9:2013-UsingComponentswith KnownVulnerabilitiesA4:2017-XMLExternalEntities(XXE)A7:2013-MissingFunctionLevel AccessControlA1:2013-InjectionA5:2017-BrokenAccessControlC5:2018-ValidateAll InputsA7:2017-Cross-SiteScripting(XSS)A6:2017-SecurityMisconfigurationC1:2018-DefineSecurityRequirementsC8:2018-ProtectDataEverywhereC10:2018-Handle allErrors andExceptionsA10:2013-UnvalidatedRedirectsandForwardsC4:2018-Encode andEscape DataA4:2013-InsecureDirect ObjectReferencesA8:2017-InsecureDeserializationA5:2013-SecurityMisconfigurationC2:2018-LeverageSecurityFrameworksand LibrariesC9:2018-ImplementSecurityLogging andMonitoringA6:2013-SensitiveDataExposureA2:2017-BrokenAuthenticationA8:2013-Cross-SiteRequestForgery(CSRF)A10:2017-InsufficientLogging &MonitoringC7:2018-EnforceAccessControlsA1:2017-InjectionA2:2013-BrokenAuthenticationand SessionManagementA3:2017-SensitiveDataExposureC6:2018-ImplementDigitalIdentityA9:2017-UsingComponentswith KnownVulnerabilitiesC3:2018-SecureDatabaseAccessA3:2013-Cross-SiteScripting(XSS)A9:2013-UsingComponentswith KnownVulnerabilitiesA4:2017-XMLExternalEntities(XXE)

Stash OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
  1. A7:2013-Missing Function Level Access Control
  2. A1:2013-Injection
  3. A5:2017-Broken Access Control
  4. C5:2018-Validate All Inputs
  5. A7:2017-Cross-Site Scripting (XSS)
  6. A6:2017-Security Misconfiguration
  7. C1:2018-Define Security Requirements
  8. C8:2018-Protect Data Everywhere
  9. C10:2018-Handle all Errors and Exceptions
  10. A10:2013-Unvalidated Redirects and Forwards
  11. C4:2018-Encode and Escape Data
  12. A4:2013-Insecure Direct Object References
  13. A8:2017-Insecure Deserialization
  14. A5:2013-Security Misconfiguration
  15. C2:2018-Leverage Security Frameworks and Libraries
  16. C9:2018-Implement Security Logging and Monitoring
  17. A6:2013-Sensitive Data Exposure
  18. A2:2017-Broken Authentication
  19. A8:2013-Cross-Site Request Forgery (CSRF)
  20. A10:2017-Insufficient Logging & Monitoring
  21. C7:2018-Enforce Access Controls
  22. A1:2017-Injection
  23. A2:2013-Broken Authentication and Session Management
  24. A3:2017-Sensitive Data Exposure
  25. C6:2018-Implement Digital Identity
  26. A9:2017-Using Components with Known Vulnerabilities
  27. C3:2018-Secure Database Access
  28. A3:2013-Cross-Site Scripting (XSS)
  29. A9:2013-Using Components with Known Vulnerabilities
  30. A4:2017-XML External Entities (XXE)