1. Top 10 Application Security Risk(2010)
   1. A1 Injection（注入）
      1. OWASP's ESAPI
      2. ESAPI Encoder API
      3. ESAPI Input Validation API
   2. A2 Cross-Site-Scripting(XSS) （跨站脚本攻击）
      1. ESAPI Encoder API
   3. A3 Broken Authentication and Session Mangment （破坏认证与session管理）
      1. OWASP's Application Security Verification Standard (ASVS)
      2. ESAPI Authenticator and User APIs
      3. ESAPI Authenticator API
      4. ESAPI User API
   4. A4 Insecure Direct Object Reference （不安全的直接目标引用）
      1. OWASP's ESAPI
      2. ESAPI Access Reference Map API
      3. ESAPI Access Control API
   5. A5 Cross-Site Request Forgery （跨站伪造请求）
      1. CSRF Tester tool
      2. CSRF Guard
      3. ESAPI HTTPUtilities Class with AntiCSRF Tokens
   6. A6 Security Misconfiguration （错误的安全配置）
   7. A7 Insecure Cryptographic Storage （不安全的加密存贮）
      1. ESAPI Encryptor API
   8. A8 Failure to Restrict URL Access （错误的限制URL访问）
      1. ESAPI Access Control API
      2. OWASP Development Guide: Chapter on Authorization
      3. OWASP Testing Guide: Testing for Path Traversal
      4. OWASP Article on Forced Browsing
   9. A9 Insufficient Transport Layer Protection （不充分的传输层保护）
   10. A10 Unvalidated Redirects and Forwards （未经检查的重定向与转发）
2. OWASP Developer's Guide
3. OWASP Testing Guide
4. OWASP Code Review Guide
5. Application Security Verification Standart(ASVS)
6. Open Source Assurance Maturity Model(SAMM)
7. OWASP Risk Rating Methodology
8. OWASP Enterprise Security API
9. OWASP Application Security Verification Standard Project