Home > cards

The Card Decks

Both current decks have six suits and there are also two Joker cards. Each suit contains 13 cards (Ace, 2-10, Jack, Queen and King). This page contains the card browser where you can browse through each of the cards in the OWASP Cornucopia decks.

data-validation-&-encoding VEA

data-validation-&-encoding VE2

data-validation-&-encoding VE3

data-validation-&-encoding VE4

data-validation-&-encoding VE5

data-validation-&-encoding VE6

data-validation-&-encoding VE7

data-validation-&-encoding VE8

data-validation-&-encoding VE9

data-validation-&-encoding VEX

data-validation-&-encoding VEJ

data-validation-&-encoding VEQ

data-validation-&-encoding VEK

session-management SMA

session-management SM2

session-management SM3

session-management SM4

session-management SM5

session-management SM6

session-management SM7

session-management SM8

session-management SM9

session-management SMX

session-management SMJ

session-management SMQ

session-management SMK

Website App version

For the previously called Ecommerce Website Edition. Instead of EoP’s STRIDE suits, the suits were selected based on the structure of the OWASP Secure Coding Practices - Quick Reference Guide (SCP) which have been migrated to the OWASP Developer Guide Web Application Checklist. The content was mainly drawn from the SCP but with additional consideration of sections in the OWASP Application Security Verification Standard, the OWASP Web Security Testing Guide and David Rook's Principles of Secure Development. These provided five suits, and a sixth called “Cornucopia” was created for everything else:

└── DATA VALIDATION & ENCODING

└── AUTHENTICATION

└── SESSION MANAGEMENT

└── AUTHORIZATION

└── CRYPTOGRAPHY

└── CORNUCOPIA

└── WILD CARD

DATA VALIDATION & ENCODING

Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code

STRIDE

OWASP DevGuide

SC1,SC2,SC3,SC4,SC8,SC9,SC10,SC11,SC12,SC13,FM1,FM2,FM5,EE6,EE7,EE8

OWASP ASVS

1.6.4,2.10.4,4.3.2,7.1.1,10.2.3,14.1.1,14.2.2,14.3.3

CAPEC™

54,113,116,143,144,149,150,155,169,215,224,497,541

SAFECODE

4,23

Website App version

└── DATA VALIDATION & ENCODING

└── AUTHENTICATION

└── SESSION MANAGEMENT

├── SMJ

└── AUTHORIZATION

└── CRYPTOGRAPHY

├── CR4

├── CR9

├── CRX

└── CORNUCOPIA

└── WILD CARD

Mobile App version

The second Cornucopia deck, the “Mobile App Edition”, follows the same principles and game rules as the original OWASP Cornucopia, but has different suits based on the MASVS categories, in addition to the Cornucopia suit that contains threats related to mobile malware and privacy issues: