API8:2023 -SecurityMisconfigurationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA10:2017-InsufficientLogging &MonitoringAPI9:2023 -ImproperInventoryManagementA7:2017-Cross-SiteScripting(XSS)A6:2017-SecurityMisconfigurationA9:2013-UsingComponentswith KnownVulnerabilitiesA2:2017-BrokenAuthenticationC2:2018-LeverageSecurityFrameworksand LibrariesAPI2:2023 -BrokenAuthenticationA5:2013-SecurityMisconfigurationA9:2017-UsingComponentswith KnownVulnerabilitiesA7:2013-MissingFunctionLevel AccessControlA4:2017-XMLExternalEntities(XXE)API1:2023 -BrokenObject LevelAuthorizationA8:2017-InsecureDeserializationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA1:2013-InjectionAPI4:2023 -UnrestrictedResourceConsumptionA3:2013-Cross-SiteScripting(XSS)API3:2023 -Broken ObjectPropertyLevelAuthorizationC3:2018-SecureDatabaseAccessA3:2017-SensitiveDataExposureC4:2018-Encode andEscapeDataAPI10:2023 -UnsafeConsumptionof APIsA1:2017-InjectionA8:2013-Cross-SiteRequestForgery(CSRF)A10:2013-UnvalidatedRedirectsandForwardsA6:2013-SensitiveDataExposureA4:2013-InsecureDirect ObjectReferencesC1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlAPI5:2023 -BrokenFunctionLevelAuthorizationA2:2013-BrokenAuthenticationand SessionManagementAPI8:2023 -SecurityMisconfigurationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA10:2017-InsufficientLogging &MonitoringAPI9:2023 -ImproperInventoryManagementA7:2017-Cross-SiteScripting(XSS)A6:2017-SecurityMisconfigurationA9:2013-UsingComponentswith KnownVulnerabilitiesA2:2017-BrokenAuthenticationC2:2018-LeverageSecurityFrameworksand LibrariesAPI2:2023 -BrokenAuthenticationA5:2013-SecurityMisconfigurationA9:2017-UsingComponentswith KnownVulnerabilitiesA7:2013-MissingFunctionLevel AccessControlA4:2017-XMLExternalEntities(XXE)API1:2023 -BrokenObject LevelAuthorizationA8:2017-InsecureDeserializationAPI6:2023 -UnrestrictedAccess toSensitiveBusiness FlowsA1:2013-InjectionAPI4:2023 -UnrestrictedResourceConsumptionA3:2013-Cross-SiteScripting(XSS)API3:2023 -Broken ObjectPropertyLevelAuthorizationC3:2018-SecureDatabaseAccessA3:2017-SensitiveDataExposureC4:2018-Encode andEscapeDataAPI10:2023 -UnsafeConsumptionof APIsA1:2017-InjectionA8:2013-Cross-SiteRequestForgery(CSRF)A10:2013-UnvalidatedRedirectsandForwardsA6:2013-SensitiveDataExposureA4:2013-InsecureDirect ObjectReferencesC1:2018-DefineSecurityRequirementsA5:2017-BrokenAccessControlAPI5:2023 -BrokenFunctionLevelAuthorizationA2:2013-BrokenAuthenticationand SessionManagement

API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
  1. API8:2023 - Security Misconfiguration
  2. API6:2023 - Unrestricted Access to Sensitive Business Flows
  3. A10:2017-Insufficient Logging & Monitoring
  4. API9:2023 - Improper Inventory Management
  5. A7:2017-Cross-Site Scripting (XSS)
  6. A6:2017-Security Misconfiguration
  7. A9:2013-Using Components with Known Vulnerabilities
  8. A2:2017-Broken Authentication
  9. C2:2018-Leverage Security Frameworks and Libraries
  10. API2:2023 - Broken Authentication
  11. A5:2013-Security Misconfiguration
  12. A9:2017-Using Components with Known Vulnerabilities
  13. A7:2013-Missing Function Level Access Control
  14. A4:2017-XML External Entities (XXE)
  15. API1:2023 - Broken Object Level Authorization
  16. A8:2017-Insecure Deserialization
  17. API6:2023 - Unrestricted Access to Sensitive Business Flows
  18. A1:2013-Injection
  19. API4:2023 - Unrestricted Resource Consumption
  20. A3:2013-Cross-Site Scripting (XSS)
  21. API3:2023 - Broken Object Property Level Authorization
  22. C3:2018-Secure Database Access
  23. A3:2017-Sensitive Data Exposure
  24. C4:2018-Encode and Escape Data
  25. API10:2023 - Unsafe Consumption of APIs
  26. A1:2017-Injection
  27. A8:2013-Cross-Site Request Forgery (CSRF)
  28. A10:2013-Unvalidated Redirects and Forwards
  29. A6:2013-Sensitive Data Exposure
  30. A4:2013-Insecure Direct Object References
  31. C1:2018-Define Security Requirements
  32. A5:2017-Broken Access Control
  33. API5:2023 - Broken Function Level Authorization
  34. A2:2013-Broken Authentication and Session Management