Whaddup y'all.. Besides the well-known CVSS, there’s actually an alternative risk assessment method, especially for web pentests, called the OWASP Risk Rating. As the name suggests, this method is provided by the OWASP organization. Luckily, someone made a calculator so you don’t have to manually calculate the score. But it still uses pretty formal language, which can be confusing sometimes. I’ve made a simpler explanation for each factor, hope it helps you understand better!🔥 1. Likelihood Factors The first step is to estimate how likely it is that an attacker will find and exploit the vulnerability. There are two sub-factors: the threat agent factor and the vulnerability factor. a) Threat Agent Factors b) Vulnerability Factors 2. Impact Factors After a successful attack, the next step is to estimate the technical and business impacts of the vulnerability. There are two sub-factors: the technical impact factor and the business impact factor. a) Technical Impact Factors b) B...
