OWASP Top 10

Overview of OWASP Top 10 course, prerequisites and modules

Introduces A01, the authentication vs. authorization distinction, and links to the Tenant Zero course for complete coverage of IDOR, privilege escalation, mass assignment, fine-grained authorization, and AI-assisted review.

Covers time-of-check/time-of-use bugs where the state verified during an access decision differs from the state acted on. Uses the Steam privilege escalation incident.

Complete this hands-on lab to put your learning into practice.

Covers HTTP security headers, CORS policy, and cookie attributes. Links to the Frontend Security course for full coverage.

Covers default credentials, debug endpoints, overpermissioned cloud resources, and the metadata endpoint exposure pattern.

Covers how stack traces, database errors, and internal paths handed to callers give attackers a map of application internals.

Introduces the supply chain attack surface using the XZ Utils, Codecov, and SolarWinds incidents. Links to the Supply Chain Security course for full coverage.

Uses the 2013 Adobe breach to show how misclassifying sensitive data leads to cryptographic failures. Covers where sensitive data reaches unprotected destinations: logs, responses, URLs, and error messages.

Covers MD5/SHA1 for passwords (LinkedIn breach), ECB mode, hardcoded keys, insecure randomness, and certificate validation failures.

Uses the 2021 Travis CI exposure to frame the secret lifecycle: creation, storage, distribution, and rotation. Covers secrets managers and the paths through which secrets reach logs and version control.

Introduces injection as a vulnerability class and XSS as its browser-side form. Links to the Frontend Security course for complete coverage.

Complete this hands-on lab to put your learning into practice.

Covers string-concatenated queries, parameterized queries, and ORM pitfalls that reintroduce injection through raw query interfaces.

Complete this hands-on lab to put your learning into practice.

Covers user input reaching shell execution functions and safe argument-list alternatives across Python, Java, Node, and Go.

Complete this hands-on lab to put your learning into practice.

Covers template engines that evaluate user-supplied expressions, escalating to remote code execution. Uses the Uber Rider RCE incident.

Complete this hands-on lab to put your learning into practice.

Covers pathological regular expressions that produce exponential matching time. Uses the Stack Overflow outage incident.

Complete this hands-on lab to put your learning into practice.

Covers confusable Unicode characters as an injection vector in identifiers and routing logic. Uses the Spotify Bigbird incident.

Complete this hands-on lab to put your learning into practice.

Distinguishes design-level vulnerabilities from implementation bugs. Links to the Rapid Threat Modelling course for full coverage.

Covers server-side logic fetching attacker-controlled URLs. Uses the Capital One breach as the exploitation chain.

Complete this hands-on lab to put your learning into practice.

Covers workflow bypasses, negative values, single-use constraint failures, and race conditions -- the class no scanner finds.

Covers browser token storage, HttpOnly cookies, and SPA authentication patterns. Links to the Frontend Security course for full coverage.

Covers bcrypt and Argon2id, cost parameter calibration, and transparent migration from MD5/SHA1 without forcing a password reset.

Introduces session fixation, JWT signature bypass attacks (alg:none, algorithm confusion, JWKS injection), and links to the Tenant Zero course for complete coverage.

Covers rate limiting, progressive lockout, MFA, and the bypass patterns that defeat naive implementations. Includes timing equalisation for username enumeration prevention.

Covers CI/CD action pinning and subresource integrity. Links to Supply Chain Security and Frontend Security courses for full coverage.

Covers mass assignment and binary deserialization (pickle, Java serialization) as two forms of the same failure. Uses the 2012 GitHub incident.

Complete this hands-on lab to put your learning into practice.

Covers what code signing guarantees, parser differentials as a bypass class, and the Android Master Key vulnerability.

Complete this hands-on lab to put your learning into practice.

Uses the Uber breach cover-up (1 year undetected) and the Equifax breach (78 days undetected) to frame why logging failures are a vulnerability class. Covers which events make a breach detectable and links to the Secure Logging course.

Covers how fixed-width integer arithmetic wraps silently and becomes exploitable. Uses the Boeing 787 electrical shutdown incident.

Boeing 787 Lab

In this lab, you will learn how to find, exploit and fix a numeric overflow (integer overflow) vulnerability in a program inspired by Boeing 787 shutdown incident.

Covers floating-point rounding imprecision and approximate representation past 2^53^, and why money and identifiers must not be binary floats. Uses the 1991 Patriot missile failure as the case study.

Covers missing bounds checks, ignored return values, and partial state in security operations. Uses the Heartbleed vulnerability as the case study.