mozg.betaSign in

explore / Security / mozg

OWASP Cheat Sheets

Answer application-security questions the way the OWASP cheat sheets specify today: the concrete controls for authentication, session management, input validation, XSS, CSRF, SQL injection, secrets, JWTs, file uploads and the rest — named headers, named settings and named algorithms, not general advice.

3577 notes · updated 2026-08-04 · trained 35%

since last sitting: +2 newly passed — this brain is learning

Ask it things like

answers 10/28 on its latest exam
What does OMB M-22-09 mandate for U.S. federal agencies, and what authentication method is recommended as phishing-resistant?Authentication✓
According to OWASP, where should secrets (API keys, database credentials) be stored in production, and what tool is recommended?Secrets Management✓
What is the OWASP Session Management cheat sheet recommendation for session token storage in modern web apps?Session Management✓
According to OWASP, what is the minimum access control principle that should be applied to all user roles?Authentication✓
What is just-in-time (JIT) access and how does it differ from permanent admin rights?Authentication✓
What is the purpose of the SameSite cookie attribute, and what are the three valid values OWASP recognizes?CSRF Protection✓
According to OWASP, which HTTP methods are safe from CSRF by design, and should CSRF tokens be required on GET requests?CSRF Protection✓
What must be validated in the JWT 'iss' (issuer) and 'aud' (audience) claims, and what is the security risk if omitted?JWT Security✓
use this brain
# sign in to get a token
$ claude mcp add --transport http mozg \
https://mozg.sh/mcp --header "Authorization: Bearer …"
> use mozg/owasp-cheatsheets — …
Get a token

Use this brain

Sign in and add it, and every agent you have connected can read it — nothing to download, and it stays current as the author updates it.

Sign in to add it

What it can answer

28 checks
35%
▲Authentication3 / 4
▲CSRF Protection2 / 3
▲JWT Security2 / 3
✓Session Management2 / 2
▲Secrets Management1 / 2
✕Cryptography0 / 2
✕File Upload Security0 / 2
✕Input Validation0 / 3
✕SQL Injection Prevention0 / 2
✕XSS Prevention Controls0 / 3
✕Zero Trust Architecture0 / 2
exam badge — share this score →

Inside

  • XSS via IMG SRC Filter Bypass with Hash · application_security/xss
  • XSS via Decimal HTML Character References Without Trailing Semicolons · application_security/xss
  • XSS Polyglot Payload for Multiple Contexts · application_security/xss
  • XSS via String.fromCharCode without Quotes · application_security/xss
  • XSS via IMG onerror Event · application_security/xss
  • XSS via Decimal HTML Character References in Href · application_security/xss
  • XSS via Script Tag with Slash Before SRC · application_security/xss
  • XSS via Script Tag with Remote Source · application_security/xss
  • XSS via Malformed Anchor Tag with onmouseover · application_security/xss
  • XSS via Malformed IMG Tag · application_security/xss
  • XSS via IMG SRC with Empty Value · application_security/xss
  • XSS via IMG SRC Omitted Entirely · application_security/xss
  • XSS via IMG onerror with Decimal HTML Character References · application_security/xss
  • XSS via Hexadecimal HTML Character References Without Trailing Semicolons · application_security/xss

Licence

CC BY-NC-SA 4.0

Use it, copy it, build on it, with credit. Selling it is not allowed.