A1:2017-InjectionC6:2018-ImplementDigitalIdentityA3:2017-SensitiveDataExposureC4:2018-Encode andEscape DataA8:2013-Cross-SiteRequestForgery(CSRF)A9:2013-UsingComponentswith KnownVulnerabilitiesC9:2018-ImplementSecurityLogging andMonitoringC7:2018-EnforceAccessControlsA7:2013-MissingFunctionLevel AccessControlA7:2017-Cross-SiteScripting(XSS)C1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlC5:2018-ValidateAll InputsA1:2013-InjectionA4:2017-XMLExternalEntities(XXE)A3:2013-Cross-SiteScripting(XSS)A2:2017-BrokenAuthenticationC2:2018-LeverageSecurityFrameworksand LibrariesA6:2013-SensitiveDataExposureA4:2013-InsecureDirect ObjectReferencesC10:2018-Handle allErrors andExceptionsC3:2018-SecureDatabaseAccessA2:2013-BrokenAuthenticationand SessionManagementA10:2013-UnvalidatedRedirectsandForwardsC8:2018-ProtectDataEverywhereA6:2017-SecurityMisconfigurationA8:2017-InsecureDeserializationA5:2013-SecurityMisconfigurationA10:2017-InsufficientLogging &MonitoringA9:2017-UsingComponentswith KnownVulnerabilitiesA1:2017-InjectionC6:2018-ImplementDigitalIdentityA3:2017-SensitiveDataExposureC4:2018-Encode andEscape DataA8:2013-Cross-SiteRequestForgery(CSRF)A9:2013-UsingComponentswith KnownVulnerabilitiesC9:2018-ImplementSecurityLogging andMonitoringC7:2018-EnforceAccessControlsA7:2013-MissingFunctionLevel AccessControlA7:2017-Cross-SiteScripting(XSS)C1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlC5:2018-ValidateAll InputsA1:2013-InjectionA4:2017-XMLExternalEntities(XXE)A3:2013-Cross-SiteScripting(XSS)A2:2017-BrokenAuthenticationC2:2018-LeverageSecurityFrameworksand LibrariesA6:2013-SensitiveDataExposureA4:2013-InsecureDirect ObjectReferencesC10:2018-Handle allErrors andExceptionsC3:2018-SecureDatabaseAccessA2:2013-BrokenAuthenticationand SessionManagementA10:2013-UnvalidatedRedirectsandForwardsC8:2018-ProtectDataEverywhereA6:2017-SecurityMisconfigurationA8:2017-InsecureDeserializationA5:2013-SecurityMisconfigurationA10:2017-InsufficientLogging &MonitoringA9:2017-UsingComponentswith KnownVulnerabilities

Stash OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
  1. A1:2017-Injection
  2. C6:2018-Implement Digital Identity
  3. A3:2017-Sensitive Data Exposure
  4. C4:2018-Encode and Escape Data
  5. A8:2013-Cross-Site Request Forgery (CSRF)
  6. A9:2013-Using Components with Known Vulnerabilities
  7. C9:2018-Implement Security Logging and Monitoring
  8. C7:2018-Enforce Access Controls
  9. A7:2013-Missing Function Level Access Control
  10. A7:2017-Cross-Site Scripting (XSS)
  11. C1:2018-Define Security Requirements
  12. A5:2017-Broken Access Control
  13. C5:2018-Validate All Inputs
  14. A1:2013-Injection
  15. A4:2017-XML External Entities (XXE)
  16. A3:2013-Cross-Site Scripting (XSS)
  17. A2:2017-Broken Authentication
  18. C2:2018-Leverage Security Frameworks and Libraries
  19. A6:2013-Sensitive Data Exposure
  20. A4:2013-Insecure Direct Object References
  21. C10:2018-Handle all Errors and Exceptions
  22. C3:2018-Secure Database Access
  23. A2:2013-Broken Authentication and Session Management
  24. A10:2013-Unvalidated Redirects and Forwards
  25. C8:2018-Protect Data Everywhere
  26. A6:2017-Security Misconfiguration
  27. A8:2017-Insecure Deserialization
  28. A5:2013-Security Misconfiguration
  29. A10:2017-Insufficient Logging & Monitoring
  30. A9:2017-Using Components with Known Vulnerabilities