Skip to content

ASVS Index / ASVS 指数

Table of Contents / 目录

Objective / 客观的

The objective of this index is to help an OWASP Application Security Verification Standard (ASVS) user clearly identify which cheat sheets are useful for each section during his or her usage of the ASVS.

本索引的目的是帮助 OWASP 应用程序安全验证标准 (ASVS) 用户在使用 ASVS 时,清楚地识别哪些速查表对每个部分是有用的。

This index is based on the version 5.0.x of the ASVS.

本索引基于 ASVS 的 5.0.x 版本。

V1: Encoding and Sanitization / V1: 编码和清理

V1.1 Encoding and Sanitization Architecture / V1.1 编码和清理架构

Security Terminology Cheat Sheet (安全术语速查表)

Cross Site Scripting Prevention Cheat Sheet (跨站脚本攻击预防技巧清单)

V1.2 Injection Prevention / V1.2 注入预防

Bean Validation Cheat Sheet (Bean Validation 快速参考)

Cross Site Scripting Prevention Cheat Sheet (跨站脚本攻击预防技巧清单)

DOM based XSS Prevention Cheat Sheet (基于DOM的XSS防护技巧清单)

File Upload Cheat Sheet (文件上传技巧清单)

Injection Prevention Cheat Sheet (注入防护速查表)

Input Validation Cheat Sheet (输入验证作弊指南)

Java Security Cheat Sheet (Java安全速查表)

LDAP Injection Prevention (LDAP注入防护)

OS Command Injection Defense (操作系统命令注入防御)

Query Parameterization Cheat Sheet (查询参数化备忘单)

SQL Injection Prevention (SQL 注入防护)

XML Security Cheat Sheet (XML安全备忘录)

XSS Filter Evasion Cheat Sheet (XSS 滤波器绕过技巧表)

XML External Entity Prevention Cheat Sheet (XML外部实体预防技巧表)

V1.3 Sanitization / V1.3 清理

Cross-Site Request Forgery Prevention Cheat Sheet

Cross Site Scripting Prevention Cheat Sheet (跨站脚本攻击预防技巧清单)

DOM based XSS Prevention Cheat Sheet (基于DOM的XSS防护技巧清单)

Injection Prevention Cheat Sheet (注入防护速查表)

Injection Prevention Cheat Sheet in Java (Java 注入防护速查表)

Input Validation Cheat Sheet (输入验证作弊指南)

LDAP Injection Prevention (LDAP注入防护)

Server Side Request Forgery Prevention Cheat Sheet (服务器端请求伪造防护速查表)

XML External Entity Prevention Cheat Sheet (XML外部实体预防技巧表)

V1.4 Memory, String, and Unmanaged Code / V1.4 内存、字符串和非托管代码

None.

V1.5 Safe Deserialization / V1.5 安全反序列化

Deserialization Cheat Sheet (反序列化技巧指南)

Server Side Request Forgery Prevention Cheat Sheet (服务器端请求伪造防护速查表)

XML Security Cheat Sheet (XML安全备忘录)

XML External Entity Prevention Cheat Sheet (XML外部实体预防技巧表)

V2: Validation and Business Logic / V2: 验证和业务逻辑

V2.1 Validation and Business Logic Documentation / V2.1 验证和业务逻辑文档

Abuse Case Cheat Sheet (滥用案例速查表)

V2.2 Input Validation / V2.2 输入验证

Input Validation Cheat Sheet (输入验证作弊指南)

Microservices Security Cheat Sheet (微服务安全速查表)

Web Service Security Cheat Sheet (Web服务安全速查表)

V2.3 Business Logic Security / V2.3 业务逻辑安全

Abuse Case Cheat Sheet (滥用案例速查表)

V2.4 Anti-automation / V2.4 反自动化

Denial of Service Cheat Sheet (拒绝服务攻击应急指南)

V3: Web Frontend Security / V3: 网页前端安全

V3.1 Web Frontend Security Documentation / V3.1 网页前端安全文档

Content Security Policy Cheat Sheet

Cross-Site Request Forgery Prevention Cheat Sheet

HTTP Strict Transport Security Cheat Sheet (HTTP严格传输安全备忘录)

V3.2 Unintended Content Interpretation / V3.2 非预期内容解释

Cross-Site Request Forgery Prevention Cheat Sheet

DOM Clobbering Prevention Cheat Sheet (DOM 混淆防护速查表)

HTML5 Security Cheat Sheet (HTML5安全速查表)

Third Party Javascript Management Cheat Sheet (第三方JavaScript管理速查表)

Cross-Site Request Forgery Prevention Cheat Sheet

Session Management Cheat Sheet (会话管理速查表)

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V3.4 Browser Security Mechanism Headers / V3.4 浏览器安全机制头部

Cross-Site Request Forgery Prevention Cheat Sheet

HTML5 Security Cheat Sheet (HTML5安全速查表)

HTTP Strict Transport Security Cheat Sheet (HTTP严格传输安全备忘录)

V3.5 Browser Origin Separation / V3.5 浏览器源分离

Cross-Site Request Forgery Prevention Cheat Sheet

HTML5 Security Cheat Sheet (HTML5安全速查表)

Micro Frontend Security Cheat Sheet (微前端安全速查表)

V3.6 External Resource Integrity / V3.6 外部资源完整性

Third Party Javascript Management Cheat Sheet (第三方JavaScript管理速查表)

V3.7 Other Browser Security Considerations / V3.7 其他浏览器安全考虑因素

Cross-Site Request Forgery Prevention Cheat Sheet

HTTP Strict Transport Security Cheat Sheet (HTTP严格传输安全备忘录)

Third Party Javascript Management Cheat Sheet (第三方JavaScript管理速查表)

Unvalidated Redirects and Forwards Cheat Sheet (未经验证的跳转和转发备忘录)

V4: API and Web Service / V4: API 和网络服务

V4.1 Generic Web Service Security / V4.1 通用网络服务安全

Cross-Site Request Forgery Prevention Cheat Sheet

FastAPI Security Cheat Sheet (FastAPI 安全速查表)

REST Assessment Cheat Sheet (REST评估作弊表)

REST Security Cheat Sheet (REST安全速查表)

Transport Layer Security Cheat Sheet (传输层安全性速查表)

Web Service Security Cheat Sheet (Web服务安全速查表)

V4.2 HTTP Message Structure Validation / V4.2 HTTP 消息结构验证

REST Security Cheat Sheet (REST安全速查表)

Web Service Security Cheat Sheet (Web服务安全速查表)

V4.3 GraphQL

REST Security Cheat Sheet (REST安全速查表)

V4.4 WebSocket

REST Security Cheat Sheet (REST安全速查表)

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V5: File Handling / V5: 文件处理

V5.1 File Handling Documentation / V5.1 文件处理文档

Input Validation Cheat Sheet (输入验证作弊指南)

File Upload Cheat Sheet (文件上传技巧清单)

V5.2 File Upload and Content / V5.2 文件上传和内容

Input Validation Cheat Sheet (输入验证作弊指南)

File Upload Cheat Sheet (文件上传技巧清单)

V5.3 File Storage / V5.3 文件存储

Input Validation Cheat Sheet (输入验证作弊指南)

Server Side Request Forgery Prevention Cheat Sheet (服务器端请求伪造防护速查表)

V5.4 File Download / V5.4 文件下载

File Upload Cheat Sheet (文件上传技巧清单)

V6: Authentication / V6: 认证

V6.1 Authentication Documentation / V6.1 认证文档

Security Terminology Cheat Sheet (安全术语速查表)

Credential Stuffing Prevention Cheat Sheet (凭证填充预防技巧清单)

V6.2 Password Security / V6.2 密码安全性

Authentication Cheat Sheet (身份验证备忘单)

V6.3 General Authentication Security / V6.3 通用认证安全性

Authentication Cheat Sheet (身份验证备忘单)

Credential Stuffing Prevention Cheat Sheet (凭证填充预防技巧清单)

Forgot Password Cheat Sheet (忘记密码作弊表)

V6.4 Authentication Factor Lifecycle and Recovery / V6.4 认证因素生命周期与恢复

Choosing and Using Security Questions Cheat Sheet (选择和使用安全问题的备忘单)

Forgot Password Cheat Sheet (忘记密码作弊表)

Multifactor Authentication Cheat Sheet (多因素认证速查表)

V6.5 General Multi-factor authentication requirements / V6.5 通用多因素认证要求

Authentication Cheat Sheet (身份验证备忘单)

Multifactor Authentication Cheat Sheet (多因素认证速查表)

Password Storage Cheat Sheet (密码存储速查表)

Transaction Authorization Cheat Sheet (交易授权速查表)

V6.6 Out-of-Band authentication mechanisms / V6.6 线上/线下认证机制

Forgot Password Cheat Sheet (忘记密码作弊表)

Multifactor Authentication Cheat Sheet (多因素认证速查表)

V6.7 Cryptographic authentication mechanism / V6.7 密码学认证机制

Authentication Cheat Sheet (身份验证备忘单)

Multifactor Authentication Cheat Sheet (多因素认证速查表)

V6.8 Authentication with an Identity Provider / V6.8 使用身份提供者进行认证

Authentication Cheat Sheet (身份验证备忘单)

V7: Session Management / V7: 会话管理

Session Management Cheat Sheet (会话管理速查表)

V7.1 Session Management Documentation / V7.1 会话管理文档

Session Management Cheat Sheet (会话管理速查表)

V7.2 Fundamental Session Management Security / V7.2 基础会话管理安全

Session Management Cheat Sheet (会话管理速查表)

V7.3 Session Timeout / V7.3 会话超时

Session Management Cheat Sheet (会话管理速查表)

V7.4 Session Termination / V7.4 会话终止

Session Management Cheat Sheet (会话管理速查表)

V7.5 Defenses Against Session Abuse / V7.5 防止会话滥用的防御措施

Session Management Cheat Sheet (会话管理速查表)

V7.6 Federated Re-authentication / V7.6 联邦重新认证

Session Management Cheat Sheet (会话管理速查表)

V8: Authorization / V8: 授权

V8.1 Authorization Documentation / V8.1 授权文档

Security Terminology Cheat Sheet (安全术语速查表)

Authorization Cheat Sheet (授权速查表)

Authorization Testing Automation (授权测试自动化)

V8.2 General Authorization Design / V8.2 通用授权设计

Authorization Cheat Sheet (授权速查表)

Insecure Direct Object Reference Prevention Cheat Sheet (不安全直接对象引用预防速查表)

Session Management Cheat Sheet (会话管理速查表)

V8.3 Operation Level Authorization / V8.3 运行级授权

Transaction Authorization Cheat Sheet (交易授权速查表)

V8.4 Other Authorization Considerations / V8.4 其他授权考虑因素

Authorization Cheat Sheet (授权速查表)

Multi-Tenant Application Security Cheat Sheet (多租户应用安全速查表)

V9: Self-contained Tokens / V9:自包含令牌

V9.1 Token source and integrity / V9.1 令牌来源和完整性

JSON Web Token Cheat Sheet (JSON Web 令牌速查表)

SAML Security Cheat Sheet (SAML安全速查表)

V9.2 Token content / V9.2 令牌内容

REST Security Cheat Sheet (REST安全速查表)

V10: OAuth and OIDC / V10:OAuth 和 OIDC

V10.1 Generic OAuth and OIDC Security / V10.1 通用 OAuth 和 OIDC 安全性

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

V10.2 OAuth Client / V10.2 OAuth客户端

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

V10.3 OAuth Resource Server / V10.3 OAuth资源服务器

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V10.4 OAuth Authorization Server / V10.4 OAuth授权服务器

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

Transport Layer Security Cheat Sheet (传输层安全性速查表)

Unvalidated Redirects and Forwards Cheat Sheet (未经验证的跳转和转发备忘录)

V10.5 OIDC Client / V10.5 OIDC客户端

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

V10.6 OpenID Provider / V10.6 OpenID提供者

OAuth 2.0 Protocol Cheatsheet (OAuth 2.0 协议速查表)

Browser Extension Security Vulnerabilities (浏览器扩展安全漏洞)

Logging Cheat Sheet (日志技巧清单)

V11: Cryptography / V11: 密码学

V11.1 Cryptographic Inventory and Documentation / V11.1 密码学清单和文档

Security Terminology Cheat Sheet (安全术语速查表)

Cryptographic Storage Cheat Sheet (加密存储速查表)

Key Management Cheat Sheet (密钥管理速查表)

V11.2 Secure Cryptography Implementation / V11.2 安全加密实现

Cryptographic Storage Cheat Sheet (加密存储速查表)

V11.3 Encryption Algorithms / V11.3 加密算法

Cryptographic Storage Cheat Sheet (加密存储速查表)

Key Management Cheat Sheet (密钥管理速查表)

V11.4 Hashing and Hash-based Functions / V11.4 哈希及基于哈希的函数

Password Storage Cheat Sheet (密码存储速查表)

V11.5 Random Values / V11.5 随机值

Cryptographic Storage Cheat Sheet (加密存储速查表)

V11.6 Public Key Cryptography / V11.6 公钥加密

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V11.7 In-Use Data Cryptography / V11.7 在用数据加密

Key Management Cheat Sheet (密钥管理速查表)

Microservices Security Cheat Sheet (微服务安全速查表)

Secrets Management Cheat Sheet (秘密管理速查表)

V12: Secure Communication / V12:安全通信

V12.1 General TLS Security Guidance / V12.1 通用TLS安全指南

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V12.2 HTTPS Communication with External Facing Services / V12.2 与外部服务进行HTTPS通信

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V12.3 General Service to Service Communication Security / V12.3 通用服务间通信安全

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V13: Configuration / V13: 配置

V13.1 Configuration Documentation / V13.1 配置文档

Server Side Request Forgery Prevention Cheat Sheet (服务器端请求伪造防护速查表)

V13.2 Backend Communication Configuration / V13.2 后端通信配置

Docker Security Cheat Sheet (Docker安全速查表)

Server Side Request Forgery Prevention Cheat Sheet (服务器端请求伪造防护速查表)

V13.3 Secret Management / V13.3 密钥管理

Cryptographic Storage Cheat Sheet (加密存储速查表)

Key Management Cheat Sheet (密钥管理速查表)

V13.4 Unintended Information Leakage / V13.4 非预期信息泄露

Django Cheat Sheet (Django速查表)

GraphQL Cheat Sheet (GraphQL速查表)

Laravel Cheat Sheet (Laravel 快速参考)

NPM Security best practices (NPM 安全最佳实践)

Symfony Cheat Sheet (Symfony速查表)

V14: Data Protection / V14: 数据保护

V14.1 Data Protection Documentation / V14.1 数据保护文档

Abuse Case Cheat Sheet (滥用案例速查表)

Cryptographic Storage Cheat Sheet (加密存储速查表)

User Privacy Protection Cheat Sheet (用户隐私保护速查表)

V14.2 General Data Protection / V14.2 通用数据保护

HTML5 Security Cheat Sheet (HTML5安全速查表)

User Privacy Protection Cheat Sheet (用户隐私保护速查表)

V14.3 Client-side Data Protection / V14.3 客户端数据保护

HTML5 Security Cheat Sheet (HTML5安全速查表)

V15: Secure Coding and Architecture / V15:安全编码与架构

V15.1: Secure Coding and Architecture Documentation / V15.1:安全编码与架构文档

Security Terminology Cheat Sheet (安全术语速查表)

Abuse Case Cheat Sheet (滥用案例速查表)

Attack Surface Analysis Cheat Sheet (攻击面分析备忘单)

Dependency Graph & SBOM Best Practices Cheat Sheet (依赖关系图与SBOM最佳实践速查表)

Software Supply Chain Security (软件供应链安全)

Third Party Javascript Management Cheat Sheet (第三方JavaScript管理速查表)

Threat Modeling Cheat Sheet (威胁建模速查表)

V15.2: Security Architecture and Dependencies / V15.2:安全架构与依赖

Software Supply Chain Security (软件供应链安全)

Third Party Javascript Management Cheat Sheet (第三方JavaScript管理速查表)

Virtual Patching Cheat Sheet (虚拟补丁速查表)

Vulnerable Dependency Management Cheat Sheet (易受攻击的依赖关系管理速查表)

V15.3: Defensive Coding / V15.3:防御性编码

Mass Assignment Cheat Sheet (大量赋值攻击技巧概览)

Prototype Pollution Prevention Cheat Sheet (原型污染防护清单)

Unvalidated Redirects and Forwards Cheat Sheet (未经验证的跳转和转发备忘录)

V15.4: Safe Concurrency / V15.4:安全并发

Secure Code Review Cheat Sheet (安全代码审查速查表)

Transaction Authorization Cheat Sheet (交易授权速查表)

V16: Security Logging and Error Handling / V16:安全日志记录和错误处理

V16.1: Security Logging Documentation / V16.1:安全日志记录文档

Logging Cheat Sheet (日志技巧清单)

Logging Vocabulary Cheat Sheet (日志词汇速查表)

V16.2: General Logging / V16.2:通用日志

Logging Cheat Sheet (日志技巧清单)

Session Management Cheat Sheet (会话管理速查表)

V16.3: Security Events / V16.3:安全事件

Authorization Cheat Sheet (授权速查表)

Logging Cheat Sheet (日志技巧清单)

Logging Vocabulary Cheat Sheet (日志词汇速查表)

V16.4: Log Protection / V16.4:日志保护

Logging Cheat Sheet (日志技巧清单)

V16.5: Error Handling / V16.5:错误处理

Error Handling Cheat Sheet (错误处理技巧表)

V17: WebRTC / V17:WebRTC

V17.1 TURN Server / V17.1 TURN服务器

None.

V17.2 Media / V17.2媒体

Transport Layer Security Cheat Sheet (传输层安全性速查表)

V17.3 Signaling / V17.3信令

None.