OWASP Top 10 Ref — Libor Benes (Dr. B)

OWASP Top 10 Ref is a lightweight, privacy-first Firefox extension sidebar reference that provides instant access to OWASP Top 10 security risk test cases — all without ever leaving your browser or sending data anywhere.

🔍 WHAT OWASP TOP 10 REF DOES:
• Provides a clean sidebar with all 10 OWASP 2021 risk categories.
• Each category contains detailed subcategories with test methodologies.
• View concrete attack examples and payloads for each vulnerability.
• One-click access to official OWASP Web Security Testing Guide.
• Instant search filtering by category and subcategory names.
• Auto-expand on search to show matching content.

✨ KEY FEATURES:
• 10 risk categories with expandable subcategories.
• Smart title-only search (focused on concepts, not noise).
• Detailed "How to Test" methodologies for each vulnerability.
• Real attack examples and payloads.
• Direct links to OWASP documentation.
• Clean, responsive interface.
• Extremely lightweight (~48 KB).

🔒 SECURITY-FIRST ARCHITECTURE:
• 100% client-side – No external requests.
• No data collection – Explicitly declared in manifest.json.
• No telemetry, no analytics, no servers.
• No eval() or risky innerHTML – Safe DOM methods only.
• Proper input validation on search.
• Minimal permissions – only clipboardWrite.

📚 COVERAGE (OWASP Top 10 2021):
A01: Broken Access Control
A02: Cryptographic Failures
A03: Injection
A04: Insecure Design
A05: Security Misconfiguration
A06: Vulnerable & Outdated Components
A07: Identification & Authentication Failures
A08: Software & Data Integrity Failures
A09: Security Logging & Monitoring Failures
A10: Server-Side Request Forgery (SSRF)

💡 PERFECT FOR:
• Penetration testers needing quick payload references.
• Developers learning secure coding practices.
• Security engineers conducting assessments.
• Bug bounty hunters seeking test case inspiration.
• Students studying web application security.

🔍 SEARCH BEHAVIOR:
Searches category titles and subcategory titles only (not descriptions). This intentional design avoids excessive noise from common words in descriptions and examples. Search for vulnerability concepts like "injection", "forgery", "authentication", etc., to get focused, relevant results.

Legal & Attribution:
• This is not an official product of, or endorsed by, the OWASP Foundation.
• Content sourced from the OWASP Foundation OWASP Foundation 2021 Top 10 list.
• License: Content is used under the CC BY-SA 4.0 license.
• Trademark Usage: "OWASP" is used as an adjective followed by a noun ("OWASP Top 10 Ref") as required by OWASP trademark guidelines.

OWASP Top 10 Ref – Know the risk. Test with confidence.