C1:2018-DefineSecurityRequirementsA2:2017-BrokenAuthenticationA9:2013-UsingComponentswith KnownVulnerabilitiesAPI4:2023 -UnrestrictedResourceConsumptionA10:2017-InsufficientLogging &MonitoringA8:2017-InsecureDeserializationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA6:2017-SecurityMisconfigurationAPI5:2023 -BrokenFunctionLevelAuthorizationAPI8:2023 -SecurityMisconfigurationA4:2017-XMLExternalEntities(XXE)A7:2013-MissingFunctionLevel AccessControlC3:2018-SecureDatabaseAccessA5:2017-BrokenAccessControlA1:2017-InjectionA3:2017-SensitiveDataExposureC4:2018-Encode andEscapeDataA7:2017-Cross-SiteScripting(XSS)A9:2017-UsingComponentswith KnownVulnerabilitiesA1:2013-InjectionA10:2013-UnvalidatedRedirectsandForwardsAPI2:2023 -BrokenAuthenticationAPI9:2023 -ImproperInventoryManagementA5:2013-SecurityMisconfigurationAPI1:2023 -BrokenObject LevelAuthorizationA3:2013-Cross-SiteScripting(XSS)A4:2013-InsecureDirect ObjectReferencesA2:2013-BrokenAuthenticationand SessionManagementC2:2018-LeverageSecurityFrameworksand LibrariesAPI10:2023 -UnsafeConsumptionof APIsAPI3:2023 -Broken ObjectPropertyLevelAuthorizationA6:2013-SensitiveDataExposureA8:2013-Cross-SiteRequestForgery(CSRF)API6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsC1:2018-DefineSecurityRequirementsA2:2017-BrokenAuthenticationA9:2013-UsingComponentswith KnownVulnerabilitiesAPI4:2023 -UnrestrictedResourceConsumptionA10:2017-InsufficientLogging &MonitoringA8:2017-InsecureDeserializationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA6:2017-SecurityMisconfigurationAPI5:2023 -BrokenFunctionLevelAuthorizationAPI8:2023 -SecurityMisconfigurationA4:2017-XMLExternalEntities(XXE)A7:2013-MissingFunctionLevel AccessControlC3:2018-SecureDatabaseAccessA5:2017-BrokenAccessControlA1:2017-InjectionA3:2017-SensitiveDataExposureC4:2018-Encode andEscapeDataA7:2017-Cross-SiteScripting(XSS)A9:2017-UsingComponentswith KnownVulnerabilitiesA1:2013-InjectionA10:2013-UnvalidatedRedirectsandForwardsAPI2:2023 -BrokenAuthenticationAPI9:2023 -ImproperInventoryManagementA5:2013-SecurityMisconfigurationAPI1:2023 -BrokenObject LevelAuthorizationA3:2013-Cross-SiteScripting(XSS)A4:2013-InsecureDirect ObjectReferencesA2:2013-BrokenAuthenticationand SessionManagementC2:2018-LeverageSecurityFrameworksand LibrariesAPI10:2023 -UnsafeConsumptionof APIsAPI3:2023 -Broken ObjectPropertyLevelAuthorizationA6:2013-SensitiveDataExposureA8:2013-Cross-SiteRequestForgery(CSRF)API6:2023 -UnrestrictedAccess toSensitiveBusiness Flows

API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
  1. C1:2018-Define Security Requirements
  2. A2:2017-Broken Authentication
  3. A9:2013-Using Components with Known Vulnerabilities
  4. API4:2023 - Unrestricted Resource Consumption
  5. A10:2017-Insufficient Logging & Monitoring
  6. A8:2017-Insecure Deserialization
  7. API6:2023 - Unrestricted Access to Sensitive Business Flows
  8. A6:2017-Security Misconfiguration
  9. API5:2023 - Broken Function Level Authorization
  10. API8:2023 - Security Misconfiguration
  11. A4:2017-XML External Entities (XXE)
  12. A7:2013-Missing Function Level Access Control
  13. C3:2018-Secure Database Access
  14. A5:2017-Broken Access Control
  15. A1:2017-Injection
  16. A3:2017-Sensitive Data Exposure
  17. C4:2018-Encode and Escape Data
  18. A7:2017-Cross-Site Scripting (XSS)
  19. A9:2017-Using Components with Known Vulnerabilities
  20. A1:2013-Injection
  21. A10:2013-Unvalidated Redirects and Forwards
  22. API2:2023 - Broken Authentication
  23. API9:2023 - Improper Inventory Management
  24. A5:2013-Security Misconfiguration
  25. API1:2023 - Broken Object Level Authorization
  26. A3:2013-Cross-Site Scripting (XSS)
  27. A4:2013-Insecure Direct Object References
  28. A2:2013-Broken Authentication and Session Management
  29. C2:2018-Leverage Security Frameworks and Libraries
  30. API10:2023 - Unsafe Consumption of APIs
  31. API3:2023 - Broken Object Property Level Authorization
  32. A6:2013-Sensitive Data Exposure
  33. A8:2013-Cross-Site Request Forgery (CSRF)
  34. API6:2023 - Unrestricted Access to Sensitive Business Flows