OWASP Top 10: Comprehensive Web Application Security

Name: OWASP Top 10: Comprehensive Web Application Security
Rating: 4.5 (1168 reviews)

Master OWASP vulnerabilities & Hacking techniques : SQL injection, XSS, CSRF, RCE, XEE, Broken Authentication, and more

Created byTaoufik Z.

Last updated 3/2026

English

English [Auto],Spanish [Auto],

What you'll learn

You'll understand OWASP Top 10 Web Application Security Risks
You'll conduct attacks on Web Applications by exploiting OWASP vulnerabilities
You'll be able to identify and exploit OWASP vulnerabilities such as: SQL injection, XSS, CSRF, RCE, Broken Authentication, Sensitive Data Exposure, etc.
You'll explore how Penetration Testing is done on Web Applications
You'll learn Web Security Fundamentals

Course content

6 sections • 33 lectures • 1h 45m total length

Welcome to the course0:53
Kick off the course with an introduction to the OWASP top techniques and cross-site scripting. Set up an isolated lab environment with the tools needed for hands-on practice.
Cross-Site Scripting (XSS) Theory2:15
XSS Demo 1 - Session Hijacking3:18
XSS Demo 2 - Keylogger3:37
Exposes how cross-site scripting enables a keylogger to capture keystrokes and send them to a remote server, storing them in keys.txt, in a persistent xss scenario on the dvwa application.
Test your knowledge

What is OWASP?1:24
This video talks about the OWASP community, what it is and why it is important for web application security.
OWASP Top 10 Web Application Security Risks6:31
Explore the 2021 OWASP top ten web vulnerabilities, including broken access control, cryptographic failures, and server-side request forgery, and learn attacker techniques like injection and cross-site scripting.
Quick read : What is OWASP Top 10 ?0:32
This is if you want to skip the video and quickly read about OWASP and OWASP Top 10.

Command injection Theory3:17
Explore command injection, a critical web-application flaw that lets attackers abuse scripts to run commands on the hosting server, via http headers, and warn about shellshock and input validation.
Command Injection Demo 1 - Access System Users1:40
Demonstrates a command injection vulnerability by chaining commands, where the server runs ping first and then cat /etc/password via the input field in the DVWA demo.
Command Injection Demo 2 - Remote Code Execution1:58
Demonstrates a command injection that enables code execution by sending a bash shell via netcat to the attacker through a vulnerable app, enabling commands like listing users and network interfaces.
SQL Injection Theory3:28
SQL Injection Demo 1 - Steal Users' Credentials6:30
Demonstrates a sql injection attack on a web form to extract user data. Shows how union queries and information_schema reveal user IDs, names, and passwords.
SQL Injection Demo 2 - Blind SQL Injection7:00
Test your knowledge
Cross-Site Request Forgery (CSRF) Theory2:11
Protect against cross-site request forgery by understanding how sessions and browser trust enable attackers to change account details or transfer funds, requiring attacker-crafted requests and user trickery.
CSRF Demo - Change Victim's Password4:37
This csrf demo shows how an attacker can change an admin password via a forged request without re-authenticating, highlighting the role of csrf tokens in preventing such attacks.
Information Disclosure5:05
Explains information disclosure weaknesses in web apps, showing how exposed server versions, verbose errors, code comments, or HTML5 storage tokens reveal sensitive details, and reinforces least-privilege practices.
Path Traversal and File Inclusion Theory2:04
Path Traversal Demo - Access System Users3:38
Demonstrate path traversal and file inclusion vulnerability by manipulating the page parameter to load files from parent folders, exposing the web server root and password file.
File Inclusion Demo - Remote Code Execution Using Webshell3:12
Demonstrates remote code execution using a webshell uploaded via file upload and local file inclusion, showing how a backdoor can execute system commands and access sensitive information.
Session Management Flaws - Theory5:10
Session Management Flaws Demo - Predicting Session IDs9:11
Explore how weak session IDs can be predicted and hijacked by fuzzing requests, removing cookies, and iterating session values to identify valid sessions.
Test your knowledge
XML External Entities Injection Theory1:44
Explore how XML external entities injection exploits external entities in XML applications and web services, revealing risks of local file access and server-side request forgery.
XEE Demo - Access System Users2:54

Recon and Scanning Theory3:11
Reconnaissance Demo - Recon Tools4:20
Scanning Demo Part 1 - Scan Tools4:39
Scanning Demo Part 2 - Scan Tools5:11
Demonstrates wafw00f, a web application firewall fingerprinting toolkit, to reveal protection behind a WAF. Use openssl s_client to inspect certificates and TLS versions.
NEW: OWASP Top 10 20254:07
The OWASP Top 10 2025 list is now published. This videos goes over the categories in the list and compares with previous version.

Requirements

Basic understanding of networking concepts

Description

Welcome to "OWASP Top 10: Comprehensive Web Application Security"

In this course, we will explore together the most common attacks against web applications, referred to as OWASP TOP 10, and learn how to exploit these vulnerabilities so that you have a solid background in order to protect your assets. You will:

- Discover OWASP Top attacks and how they are performed and the tricks and techniques related to them.

- Do extensive exercises on DVWA (Damn Vulnerable Web Application) and OWASP BWA (Broken Web Applications) to see in actual practice how to attack live systems and what goes on behind the scenes.

- Learn to get information about a target domain and search for potential victims.

- See the tools most used by hackers of all levels grouped in one place; the Kali Linux distribution.

- Code some of your own scripts to get you started with advanced penetration where you will need to forge you own tools.

Some of the attacks you'll see are: SQL Injection, Command Injection, Cross-site Scripting, Cross-sitr Request Forgery, Path Traversal, File Inclusion, etc.

DISCLAIMER: This course is for educational purposes only. Use at your own risk. You must have an explicit authorization to use these techniques and similar ones on assets not owned by you. The author holds no legal responsibility whatsoever for any unlawful usage leveraging the techniques and methods described in this course.

If you like the course, please give a rating and recommend to your friends and colleagues.

Who this course is for:

IT Security practitioners that want to advance in their careers and learn specialized topics
Developers who want to gain experience in application security
Network Engineers who want to transition into cybersecurity roles
Cyber Security Managers who want to understand penetration testing, OWASP top 10, application testing, etc.
Penetration Testers who want to learn penetration techniques for web applications

OWASP Top 10: Comprehensive Web Application Security

What you'll learn

Explore related topics

Course content

Introduction and Cross-Site Scripting Kickstart4 lectures • 10min

OWASP and OWASP Top 103 lectures • 8min

Setting Up The Lab Environnment3 lectures • 1min

Understanding and Using Common Techniques16 lectures • 1hr 4min

Bonus Videos - Other techniques5 lectures • 21min

Concluding Observations2 lectures • 1min

Requirements

Description

Who this course is for: