SSRF.cs
In this challenge we learn how to exploit and fix Server Side Request Forgery.
OWASP Top 10 · 2025 edition
OWASP Top 10 Challenges in C#
Cover the OWASP Top 10:2025 with hands-on C# secure coding challenges. Your developers find and fix real vulnerabilities in real C# apps — and you get evidence of capability, not just completion.
Capability, not checkbox compliance
Hands-On Challenges for Every Category
The OWASP Top 10 is the industry benchmark for web application security — the list your auditors, customers and security team measure against. Every challenge below is a real C# application with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of secure coding capability.
A01:2025
Broken Access Control
Users acting outside their intended permissions — the most common web application risk. The 2025 edition folds Server-Side Request Forgery into this category.
A02:2025
Security Misconfiguration
Insecure default configurations, verbose errors, exposed secrets and unhardened services — now the #2 web application risk.
A03:2025
Software Supply Chain Failures
New in 2025: compromises across dependencies, build systems and distribution infrastructure, expanded from Vulnerable and Outdated Components.
A04:2025
Cryptographic Failures
Weak or missing cryptography that exposes sensitive data: predictable randomness, poor key handling, and broken token generation.
A05:2025
Injection
Untrusted data interpreted as code or commands — SQL injection, command injection, log injection, XSS and friends.
A06:2025
Insecure Design
Security flaws baked into the design itself: missing rate limits, weak password policies, and logic that can be abused even when implemented "correctly".
A07:2025
Authentication Failures
Broken login, session and token handling that lets attackers assume other users’ identities.
A09:2025
Security Logging and Alerting Failures
Missing, forgeable or unmonitored logs that let breaches go undetected. Renamed in 2025 to emphasise alerting.
Roll it out
Turn the Standard Into a Training Program
Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP Top 10 coverage to auditors, customers and the board — with evidence, not attendance sheets.