v1.0 — Full OWASP Top 10 2021 Coverage

v1.0 — Full OWASP Top 10 2021 Coverage

Phase 7 of the ROADMAP, and the 1.0 milestone. Eight atoms closing the categories the earlier phases had left open — and with them, atomicvulns now covers all ten OWASP Top 10 2021 categories, A01 through A10 (38 atoms total).

New atoms

• atom 31 — crypto-weak-hash — Insecure password storage: an unsalted MD5 digest leaked in a database dump is recovered offline with a precomputed rainbow table and replayed to log in as the victim; the fix is bcrypt, a slow salted primitive no rainbow table can be built against · A02 Cryptographic Failures
• atom 32 — crypto-ecb-mode — Insecure mode of operation: an AES-ECB session badge encrypts each 16-byte block independently, so the attacker aligns admin into its own block via a chosen email and cut-and-pastes that ciphertext over the role=user block to forge an admin badge without the key; the fix is authenticated AES-GCM · A02 Cryptographic Failures
• atom 33 — debug-enabled — Debug mode reachable: Flask app.run(debug=True) with the Werkzeug PIN disabled turns any unhandled exception into the interactive debugger, whose console runs arbitrary Python — one HTTP request returns uid=0(root) (RCE); the fix is debug=False, behind a real WSGI server in production · A05 Security Misconfiguration
• atom 34 — cors-wildcard — CORS misconfiguration: an authenticated API reflects the request Origin back with Access-Control-Allow-Credentials: true, so a hostile page reads the victim's private /account data in the browser (the literal * wildcard is a red herring — credentials force the origin-reflection vector); the fix is an exact-match allowlist · A05 Security Misconfiguration
• atom 35 — race-condition-basic — TOCTOU race: POST /withdraw reads the balance, checks it, and debits as separate steps, so twenty legitimate withdrawals fired with a single-packet attack all pass the check before any writes, overdrawing to -1900; the fix is one atomic conditional UPDATE the database serializes per row · A04 Insecure Design
• atom 36 — cve-demo — Known-vulnerable component: a config API pins PyYAML 5.3.1 (CVE-2020-14343), whose full_load still rebuilds arbitrary Python objects from a crafted document for RCE; uniquely in the repo the app.py is byte-identical between the two sides — the whole fix is one line in requirements.txt, bumping to 5.4.1 · A06 Vulnerable and Outdated Components
• atom 37 — weak-password-reset — Predictable reset token: a reset token generated with random seeded from int(time.time()) is regenerated by recovering the seed from the response Date header and replaying the PRNG, taking over the account; the fix is a CSPRNG (secrets.token_urlsafe), single-use and short-lived · A07 Identification and Authentication Failures
• atom 38 — logging-failures-demo — Missing security logging: the login rejects wrong passwords correctly but records nothing security-relevant, so a brute-force burst is invisible as an attack; the fixed side adds a structured security log plus a brute-force WARNING without blocking the login — the proof is the contrast between two docker compose logs, not something appearing · A09 Security Logging and Monitoring Failures

What this phase covers

This phase closes every category the earlier phases had left open, and with it the OWASP Top 10 2021 map is complete: pure cryptographic failures (A02) from two directions, insecure design (A04) as a concurrency race, the rest of security misconfiguration (A05), vulnerable and outdated components (A06), the rest of authentication failures (A07), and security logging and monitoring failures (A09). Every one of A01 through A10 now has at least one atom — the 1.0 milestone.

The two A02 atoms attack cryptography from opposite ends. crypto-weak-hash is about the primitive: an unsalted MD5 is not encryption to reverse but a digest to precompute, so a leaked hash falls to a rainbow table — and bcrypt, slow and salted, is a primitive no table can be built against. crypto-ecb-mode is about the mode: AES is fine, but ECB encrypts each block independently, and that determinism lets whole ciphertext blocks be rearranged to forge a role without ever touching the key; authenticated GCM removes both the determinism and the tampering. Alongside them the rest of security misconfiguration lands: debug-enabled reaches the Werkzeug console for RCE, and cors-wildcard shows the dangerous CORS setting is origin reflection with credentials, not the * wildcard the browser already refuses.

Two lessons close the Top 10, both new to the repo. cve-demo makes the point that a security fix is not always in your code: the application is byte-identical on both sides and the entire remediation is a dependency version bump — the flaw lived in a component, not a line anyone wrote. logging-failures-demo ends on an unusual note: for the first time the flaw is an absence rather than a presence, and the proof is a contrast between two logs rather than a payload landing — detection is a discipline distinct from prevention, and the fixed side blocks nothing; it only makes the attack visible.

Each atom isolates one flaw with vulnerable/ and fixed/ side by side, Burp-first walkthroughs, and bilingual docs (EN + PT-BR).

Full changelog: v0.6.0...v1.0.0