OWASP Top 10 Part 6: Insecure Design and Business Logic Flaws Explained | Ep 200
Show notes
200 episodes! Thank you to everyone who has listened, watched, and shared The Cyber Threat Perspective along the way. To mark the milestone, Brad Causey and Jordan Natter are back with Part 6 of our OWASP Top 10 series, breaking down A06: Insecure Design. These flaws show up when an application does exactly what it was designed to do, but nobody stopped to ask how that functionality could be abused. Brad and Jordan walk through what insecure design looks like in practice, share real-world war stories from pen tests and beyond, and explain how to catch these flaws before they ever reach production.
In this episode:
- Why insecure design fell from #4 to #6 in the OWASP Top 10, and why that isn’t good news
- Rate limiting, user enumeration, and why secret questions are a no go
- How a teenager’s AOL trial CD experiment turned into a career
- Abusing rewards programs, group bookings, and first-purchase coupons
- Taking over insurance accounts using publicly available census data
- Prevention through misuse cases, threat modeling, and DevSecOps
- Why a flaw caught in the design phase costs a fraction of one found in a pen test
Need web app pen testing? Visit https://securit360.com
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com