OWASP Top 10 Web Application Security Risks 2025 Edition

Learn the difference between web server and web application, and how client requests travel from browser to server, with defenses like https, ssl stripping, and hsts.

Discover how a proxy server intermediates between the client and the internet, enabling anonymity, security, and access control—then observe Burp Suite proxy setup and interceptor usage.

Explore web request and response architecture, including request line, headers, and body, and learn how HTTP version 2 and status 301 indicate moved permanently.

Explore broken access control, the first OWASP attack, with theory and labs. Learn how unauthorized access, URL tampering, and privilege escalation occur, and why server-side enforcement matters (CWE-284, CWE-285, CWE-639).

Explore broken access control by solving a lab that reveals unprotected admin functionality at an unpredictable URL, showing server-side checks and how URL manipulation can delete the user Carlos.

Learn how a user role controlled by a request parameter can access the admin panel via forgable cookies, exposing broken access control in the OWASP top 10.

solves lab four on broken access control by showing how altering the role id to 2 grants admin access through the admin panel, enabling user deletion.

Learn how URL-based access control can be circumvented by manipulating the X-Original URL header to reach a back-end admin panel, bypass front-end restrictions, and delete a user.

Demonstrates horizontal privilege escalation by altering the user id in the url to access another account and obtain an abi key, using Burp Suite to forward requests.

Trace the history of cryptography from the Caesar and Vigenère ciphers to Diffie-Hellman key exchange, and see how public keys and shared secrets secure modern communications.

Explore the main types of cryptography—symmetric encryption, asymmetric encryption, and hash functions—and see how they support confidentiality, integrity, and availability, with examples like AES, RSA, and SHA-256.

Explore cryptographic failures, including weak hashing, no salt, and no key stretching, and see how misconfigurations expose passwords in a practical lab.

Explore injection vulnerabilities from the OWASP top 10, focusing on JavaScript injection (XSS) and its stored, reflected, and dom-based forms. See how these attacks compromise data and preview XSS labs.

Learn how stored xss into HTML context with nothing encoded in a blog's comment section enables JavaScript execution when posts are viewed.

Explore a lab on stored cross-site scripting in the blog comments, injecting an alert via a crafted anchor href to trigger script execution.

Learn how Reflected XSS differs from Stored XSS, how attackers exploit vulnerable inputs via crafted links, and how proper input validation and escaping prevent these attacks.

Solve the first lab on reflected XSS by injecting unencoded html in the search box to trigger alerts, highlighting html context vulnerabilities in OWASP top 10 attacks.

Investigate a reflected cross-site scripting vulnerability in a search query tracking function, showing how angle brackets in a JavaScript string can be encoded and exploited to trigger an alert.

Explore dom-based XSS concepts and the dom's live, in-memory representation. See how client-side JavaScript uses the URL data to modify the dom and trigger attacks.

Explore a lab on dom-based cross-site scripting using location.search and document.write to demonstrate a vulnerable search query, with a step-by-step Burp Suite proxy workflow to reproduce an alert-based XSS.

Demonstrate a DOM-based cross-site scripting vulnerability in the search feature via a NRHTML sink using location.search. Show how to reproduce the attack and the need for input filtering.

Demonstrate a lab that reveals a dom-based xss vulnerability in a submit feedback page, where unfiltered location.search data injects into a jQuery anchor href.

Examine a stored DOM XSS in a blog comment and its link to DOM-based cross-site scripting in frontend. The lab uses Purpose Suite to intercept, analyze requests, and test payloads.

Learn SQL injection concepts and core sql commands like select, insert, update, and delete, and see how unsafe inputs can bypass authentication in web apps.

Explore a lab on sql injection vulnerability in the where clause that enables retrieval of hidden data, using burp suite payloads to test and exploit the product category filter.

Showcases a SQL injection vulnerability in the login function that enables login bypass of the administrator account, underscoring the need for input filtration.

Learn to perform a sql injection lab against an Oracle database, using union select to retrieve the banner from vsign$version and test column counts with order by.

Solve the lab by performing sql injection to query the database type and version on mysql and microsoft, using a union attack in the product category filter, noting oracle differences.

Learn how to exploit a SQL injection vulnerability in a non-Oracle database's product category filter to read database contents, discover user credentials, and log in as administrator.

Explore operating system command injection within the OWASP top 10 attacks, showing how unsafe user input reaches a shell to read sensitive files, run commands, escalate privileges, and compromise systems.

Explore the os command injection lab in the top 10 web attacks course, demonstrating stock checker vulnerabilities, burp suite proxy use, and semicolon injections revealing whoami output.

Explore a lab on blind operating system command injection in a feedback form, using user input to induce a 10-second delay without returning command output.

Explore insecure design as a core OWASP top 10 concept, stressing security by design from architecture to data flow and access control.

Explore how excessive trust in client-signed controls leads to insecure design and price tampering, and learn server-side validation and integrity checks to prevent it.

Investigate the insecure design in the password reset flow, showing how post and get requests enable Carlos's password reset, and outline how to redesign the reset flow.

Examine security misconfiguration in the OWASP top 10, showing how default credentials, exposed config files, and debug mode enable attackers; apply testing and fixed layered controls.

Learn how security misconfiguration in Metasploitable2-Linux is exposed and tested in a Kali Linux VMware lab, using nmap and default logins for MySQL, FTP, PostgreSQL, and Samba.

Discover how vulnerable and outdated components (libraries, frameworks, and plugins) create entry points for attackers. Secure software supply chains with dependency management and tools like SCCA and NPM Audit.

CVE provides a unique global identifier for vulnerabilities, managed by MITRE with CNA partners. Understand CVSS and EPSS to gauge severity and exploit likelihood, and follow the CVE lifecycle.

Explore identification and authentication failures, including weak passwords, lockouts, bad session handling, and missing MFA, with practical mitigations like HTTPS and rate limiting.

Explore a lab on identification and authentication failure by exploiting a broken password reset flow, demonstrating how attackers reset another user's password to gain access.

Crack the offline password lab by leveraging a cookie-stored MD5 hash and an XSS flaw to steal Carlos's stay-logged-in cookie and delete his account.

Explore software and data integrity concepts, including cryptographic hashes, digital signatures, and chain-of-trust verification, and examine common integrity failures in updates, keys, and CI/CD pipelines.