OWASP Top 10 · 2025 edition

OWASP Top 10 Challenges in Python

Cover the OWASP Top 10:2025 with hands-on Python secure coding challenges. Your developers find and fix real vulnerabilities in real Python apps — and you get evidence of capability, not just completion.

Book a Demo Explore the Mapping

Capability, not checkbox compliance

Hands-On Challenges for Every Category

The OWASP Top 10 is the industry benchmark for web application security — the list your auditors, customers and security team measure against. Every challenge below is a real Python application with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of secure coding capability.

A01:2025

Broken Access Control

Users acting outside their intended permissions — the most common web application risk. The 2025 edition folds Server-Side Request Forgery into this category.

SSRF.py

In this challenge we learn how to exploit and fix Server Side Request Forgery.

Bad Token.py

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

No Sutpo.py

This appsec challenge is inspired after Optus API incident. It has an number of security vulnerabilities in relation to API.

Steam.py

This appsec challenge is inspired by Steam client privilege escalation vulnerability. It showcase Time of Check, Time of Use (ToCToU) vulnerability.…

Capital0.py

This challenge is inspired by Capital One hack. It highlights a number of security checks that must be in place to protect against SSRF.

A02:2025

Security Misconfiguration

Insecure default configurations, verbose errors, exposed secrets and unhardened services — now the #2 web application risk.

Secret Leak.py

Secrets such as an API or encryption key are used for various security operations. Disclosure of the secret can severely undermine the security of…

Energy.py

This challenge is inspired by Energy Australia security incident. It showcase a number of security vulnerabilities on an authentication functionality.

No Sutpo.py

This appsec challenge is inspired after Optus API incident. It has an number of security vulnerabilities in relation to API.

A03:2025

Software Supply Chain Failures

New in 2025: compromises across dependencies, build systems and distribution infrastructure, expanded from Vulnerable and Outdated Components.

Curl Eval

A build step pipes a remote script straight into a shell. Harden the pipeline so it no longer executes unverified code from the network.

Dependency Confusion

A CI/CD pipeline resolves an internal package name from a public registry. Fix the workflow so a look-alike public package can never shadow your…

Target Code

A poisoned pipeline execution lets untrusted code changes run with the workflow’s privileges. Lock down what the pipeline checks out and runs.

A04:2025

Cryptographic Failures

Weak or missing cryptography that exposes sensitive data: predictable randomness, poor key handling, and broken token generation.

Randomness.ml

While there are libraries to generate random numbers, not all of them are suitable for security. This challenge will explore this weakness and ways…

UUID.py

Although RFC 4122 has explicitly stated not to assume UUIDs are random, in practice they are used as a random identifier. Some versions of UUIDs are…

Bad Token.py

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

A05:2025

Injection

Untrusted data interpreted as code or commands — SQL injection, command injection, log injection, XSS and friends.

Command Injection.py

When untrusted data is used as an argument to an external program, command injection can happen. In this appsec challenge, we explore how to exploit…

SQL Injection.py

This is a classic security challenge where an app uses a SQL database and does not use parametrised query or ORM.

Log Injection.py

Although the Log4Shell RCE vulnerability took many by surprise, log injection has been a known vulnerability, and there are numerous other edge cases…

Pollution.py

This challenge is inspired by Android Master Key security flaw. We learn a popular security design flaw that is related to misinterpretation between…

Class Pollution.py

The challenge shows a variant of JavaScript’s Prototype Pollution in Python. Specially crafted JSON input can tamper with existing classes and modify…

A06:2025

Insecure Design

Security flaws baked into the design itself: missing rate limits, weak password policies, and logic that can be abused even when implemented "correctly".

StackOverflow.py

This challenge is inspired by StackOverflow outage security incident. It showcase insecure usage of regular expression engines to perform security…

Energy.py

This challenge is inspired by Energy Australia security incident. It showcase a number of security vulnerabilities on an authentication functionality.

Bad Password.py

A password or a memorized secret must possess a variety of security features. In addition to preventing users from selecting weak passwords, the…

Bad Token.py

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

A07:2025

Authentication Failures

Broken login, session and token handling that lets attackers assume other users’ identities.

JWT.py

Official JWT libraries have done a good job in enforcing token security by default. However, there are still a number of weaknesses that can be…

Bad Password.py

A password or a memorized secret must possess a variety of security features. In addition to preventing users from selecting weak passwords, the…

Bad Token.py

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

No Sutpo.py

This appsec challenge is inspired after Optus API incident. It has an number of security vulnerabilities in relation to API.

Energy.py

This challenge is inspired by Energy Australia security incident. It showcase a number of security vulnerabilities on an authentication functionality.

A08:2025

Software or Data Integrity Failures

Code and data accepted without integrity verification: insecure deserialization, prototype pollution, and unsafe update mechanisms.

Deserialization.py

Deserialising an untrusted data can result into arbitrary code execution. This vulnerability has become more prevalent with usage of Machine Learning…

Class Pollution.py

The challenge shows a variant of JavaScript’s Prototype Pollution in Python. Specially crafted JSON input can tamper with existing classes and modify…

A09:2025

Security Logging and Alerting Failures

Missing, forgeable or unmonitored logs that let breaches go undetected. Renamed in 2025 to emphasise alerting.

Log injection.py

Although the Log4Shell RCE vulnerability took many by surprise, log injection has been a known vulnerability, and there are numerous other edge cases…

Roll it out

Turn the Standard Into a Training Program

Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP Top 10 coverage to auditors, customers and the board — with evidence, not attendance sheets.

Book a Demo Browse all challenges