This is an operational read, not a copy of the official docs. Here we share what we've actually seen on 800+ SPECTROSEC engagements.
Stays at #1. 93% of SPECTROSEC pentests find at least one finding in this category. The common patterns in 2026:
/api/users/123/orders where 123 is trivially manipulablerole: user → role: admin)Emphasis shift: less "weak TLS" (everyone's on TLS 1.3 now), more "sensitive data at rest":
Promoted to a dedicated category. Critical in cloud environments where SSRF chains into IMDS (Instance Metadata Service) to steal temporary IAM credentials.
For every category we keep an operational checklist with tools and payloads:
Category Primary tools Quick win
--------- --------------- ---------
Broken Access Ctrl Burp + Autorize ID substitution
SQL Injection sqlmap, Burp Intruder Time-based payload
XSS XSStrike, Burp Polyglot payload
SSRF SSRFmap, Burp Collaborator Blind SSRF out-of-band
Supply Chain OSV-Scanner, Syft CVEs in dependencies
Passing an OWASP audit doesn't mean you're secure. Real attackers don't follow a checklist | they chain 3-4 "medium" vulnerabilities into "critical" access.
In our most recent engagement we chained: IDOR → JWT manipulation → SSRF → IMDS → full cloud takeover. Each finding scored CVSS 5-6. The chain scored CVSS 10.
The value of a SPECTROSEC pentest is not finding 10 isolated bugs. It's showing how 3 of them become an incident report.
If you run a web application or API in production, an OWASP Top 10 assessment takes 5-10 business days, starting at €2,500. The report includes: