OWASP Top 10 in Pakistani contexts
A01 Broken Access Control: IDOR everywhere — invoice IDs, profile URLs, order numbers as sequential integers. Test: change one digit while logged in as user B; if you see user A's data, it's a finding. Local flavor: hospital portals exposing patient records by ID.
A02 Cryptographic Failures: HTTP (no TLS) login forms on .gov.pk and bank-agent portals; passwords in GET parameters (visible in logs); sensitive data in localStorage.
A03 Injection: SQLi in legacy PHP apps (search boxes, login forms) — test with ' OR '1'='1 and time-based payloads; command injection in "ping my IP" tools.
A04 Insecure Design: OTP flows without rate limits (the wallet-drain enabler), password reset via SMS with guessable tokens, "forgot CNIC" flows.
A05 Security Misconfiguration: exposed phpMyAdmin/.env files, directory listing, default creds on admin panels, verbose errors leaking stack traces.
A06 Vulnerable Components: ancient WordPress/plugins on institutional sites — check with wpscan; unpatched Confluence/Exchange (APT favorites in our region).
A07 Auth Failures: no MFA on admin accounts, weak password policies, session fixation.
A08 Integrity Failures: unsigned updates, CI/CD without review gates.
A09 Logging Failures: no audit trail = no forensics after breach.
A10 SSRF: internal-network probing via URL-fetch features.
Lab: install OWASP Juice Shop locally and find one of each category this week. That's your first red-team badge.