OWASP Top 10 · 2025 edition

OWASP Top 10 Challenges in PHP

Cover the OWASP Top 10:2025 with hands-on PHP secure coding challenges. Your developers find and fix real vulnerabilities in real PHP apps — and you get evidence of capability, not just completion.

Book a Demo Explore the Mapping

Capability, not checkbox compliance

Hands-On Challenges for Every Category

The OWASP Top 10 is the industry benchmark for web application security — the list your auditors, customers and security team measure against. Every challenge below is a real PHP application with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of secure coding capability.

A01:2025

Broken Access Control

Users acting outside their intended permissions — the most common web application risk. The 2025 edition folds Server-Side Request Forgery into this category.

CSRF.php

A state-changing endpoint accepts forged cross-site requests. Add CSRF protection without breaking legitimate use of the app.

Insufficient Session Expiration.php

Sessions keep working long after they should have died. Fix the session lifecycle so stale sessions cannot be replayed.

Path Traversal.php

User-controlled paths escape the intended directory. Contain file access to where it belongs.

SSRF.php

In this challenge we learn how to exploit and fix Server Side Request Forgery.

No Sutpo.php

This appsec challenge is inspired after Optus API incident. It has an number of security vulnerabilities in relation to API.

Steam.php

This appsec challenge is inspired by Steam client privilege escalation vulnerability. It showcase Time of Check, Time of Use (ToCToU) vulnerability.…

Capital0.php

This challenge is inspired by Capital One hack. It highlights a number of security checks that must be in place to protect against SSRF.

A02:2025

Security Misconfiguration

Insecure default configurations, verbose errors, exposed secrets and unhardened services — now the #2 web application risk.

Unparser.php

A parsing shortcut trusts input it should treat as hostile. Fix the unsafe parse before attackers weaponise it.

Insecure Normalization.php

Inconsistent input normalisation lets crafted strings slip past security checks. Normalise before you validate.

A03:2025

Software Supply Chain Failures

New in 2025: compromises across dependencies, build systems and distribution infrastructure, expanded from Vulnerable and Outdated Components.

Curl Eval

A build step pipes a remote script straight into a shell. Harden the pipeline so it no longer executes unverified code from the network.

Dependency Confusion

A CI/CD pipeline resolves an internal package name from a public registry. Fix the workflow so a look-alike public package can never shadow your…

Target Code

A poisoned pipeline execution lets untrusted code changes run with the workflow’s privileges. Lock down what the pipeline checks out and runs.

A04:2025

Cryptographic Failures

Weak or missing cryptography that exposes sensitive data: predictable randomness, poor key handling, and broken token generation.

UUID.php

Although RFC 4122 has explicitly stated not to assume UUIDs are random, in practice they are used as a random identifier. Some versions of UUIDs are…

JWT.php

Official JWT libraries have done a good job in enforcing token security by default. However, there are still a number of weaknesses that can be…

A05:2025

Injection

Untrusted data interpreted as code or commands — SQL injection, command injection, log injection, XSS and friends.

SQL Injection.php

This is a classic security challenge where an app uses a SQL database and does not use parametrised query or ORM.

Command Injection.php

When untrusted data is used as an argument to an external program, command injection can happen. In this appsec challenge, we explore how to exploit…

XSS.php

User content renders as HTML, letting scripts run in other users’ browsers. Escape output so markup stays data.

Calculator.php

A calculator app evaluates whatever expression it is given. Stop untrusted input from reaching the evaluator.

Static Code Injection.php

User input ends up inside generated PHP code. Stop data from becoming executable code.

A06:2025

Insecure Design

Security flaws baked into the design itself: missing rate limits, weak password policies, and logic that can be abused even when implemented "correctly".

ImageBoard.php

An image board trusts user uploads more than it should. Find and fix the design flaw before it is abused.

A07:2025

Authentication Failures

Broken login, session and token handling that lets attackers assume other users’ identities.

Confusable.php

Look-alike Unicode characters let attackers impersonate other identifiers. Fix the comparison so confusables cannot slip through.

OAuth.php

An OAuth flow with a broken trust assumption lets attackers sign in as someone else. Fix the flow without breaking legitimate logins.

Energy.php

This challenge is inspired by Energy Australia security incident. It showcase a number of security vulnerabilities on an authentication functionality.

A08:2025

Software or Data Integrity Failures

Code and data accepted without integrity verification: insecure deserialization, prototype pollution, and unsafe update mechanisms.

Deserialization.php

Deserialising an untrusted data can result into arbitrary code execution. This vulnerability has become more prevalent with usage of Machine Learning…

Codehub.php

A code-hosting app trusts data it should verify. Fix the integrity flaw before malicious content slips through.

A10:2025

Mishandling of Exceptional Conditions

New in 2025: improper error handling, fail-open logic and unexpected runtime states that attackers can force.

Integer Overflow.php

An arithmetic overflow flips the app into an unexpected state. Handle the boundary condition before attackers force it.

Roll it out

Turn the Standard Into a Training Program

Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP Top 10 coverage to auditors, customers and the board — with evidence, not attendance sheets.

Book a Demo Browse all challenges