Course Overview

Improve your cybersecurity skills with our comprehensive OWASP Security Course, covering the OWASP Top 10:2025. This course illuminates the critical aspects of web application security as outlined in the OWASP Top 10, a globally recognized consensus on the most perilous security risks faced by today's web applications.

Engage with our immersive training program that meticulously walks you through each vulnerability, while highlighting effective protection methods and best practices to safeguard against varied attack vectors.

Benefit from hands-on exercises where you will practice the art of ethical hacking by staging simulated attacks on a website, learning how to identify and exploit security weaknesses.

Get hands-on experience using industry-leading tools like the OWASP Zed Attack Proxy, strengthening your practical understanding of cybersecurity threats and defenses. By the end of this course, you will be well-equipped to help secure web applications against the most pressing contemporary threats.

Equip yourself with the skills to secure the digital world - join our OWASP Security Course today.

Course Prerequisites

This course is geared towards developers, but can also be attended by other roles. Basic knowledge of Web Development is required (html, javascript, xml)

Outline

Introduction

• Introduction to web security terminology
• Explanation of same origin
• Explanation of CORS
• Introduction to OWASP
• Introduction to OWASP Top 10:2025
• Differences with Top 10 2021

OWASP Top Ten 2025

What Changed Since 2021

• Security Misconfiguration jumped from #5 to #2
• Vulnerable and Outdated Components broadened into Software Supply Chain Failures
• Server-Side Request Forgery (SSRF) merged into Broken Access Control, no longer standalone
• A brand-new category: Mishandling of Exceptional Conditions
• Authentication and Logging categories renamed for clarity, scope largely unchanged

A01-Broken Access Control

• Discuss various attack vectors
• Discuss protection
• Apply the principle of least privilege
• Common URL related vulnerabilities
• Discuss CORS misconfiguration
• Cross-Site Request Forgery CSRF
• CSRF protection with XSRF tokens
• Server-Side Request Forgery (SSRF), folded into this category in 2025
• Prevent SSRF with data sanitisation and validation
• Limit SSRF impact with network segmentation
• Appreciate why SSRF and access control share a root cause: missing trust-boundary checks

A02-Security Misconfiguration

• Understand XML Entities
• Attack vectors with XML Entities
• Remote code execution (java)
• Discuss common misconfigurations
• Discuss various HTTP Security Headers
• Appreciate why this category moved up to #2 in 2025

A03-Software Supply Chain Failures

• Using Components with Known Vulnerabilities
• Using Common Vulnerability and Exposures (CVE) and National Vulnerability Database (NVD)
• Discuss known vulnerabilities
• Using tools such as dependency-check and retire.js
• Discuss risks in package registries and build systems
• Appreciate why 2025 broadened this from "Vulnerable and Outdated Components"

A04-Cryptographic Failures

• Message privacy
• Limiting deprecated ciphers
• Showcase problems with Hashing through rainbow tables
• Discuss deprecated security algorithms (hashing, padding, seeding)
• Discuss bcrypt

A05-Injection

• Discuss various Injection attack vectors (sql, jpql, ldap, …)
• Discover Various types for SQL Injection (tautology, union, stacked)
• Discuss protection against injections
• Understand obfuscation

A06-Insecure Design

• Common design and architectural mistakes
• Multi-tenant clusters and deployments
• Discuss secure design patterns
• Role of automated testing

A07-Authentication Failures

• Discuss attack vectors (known passwords, dictionary words)
• How attackers can find valid usernames
• Discuss credential stuffing
• Discuss session fixation
• Best practices for session ids

A08-Software or Data Integrity Failures

• Using checksums and hashes of software sources (e.g., container images)
• Using your repositories/registries to protect against untrusted sources
• Problems in CI/CD pipelines
• Understand the process of marshaling/unmarshalling
• Discuss vulnerabilities and prevention
• Remote code execution with Java

A09-Security Logging and Alerting Failures

• Discuss vulnerabilities in Logging & Monitoring
• using log aggregation tools (such as Loki)
• Prevent leaking sensitive information into logs
• Logs and DevSecOps (monitoring logs)
• Appreciate the shift in emphasis towards alerting, not just logging

A10-Mishandling of Exceptional Conditions

• Introduce this new 2025 category
• Discuss improper error handling
• Understand the risk of failing open instead of failing closed
• Discuss logical errors in exception paths
• Common pitfalls in try/catch and error-boundary code
• Review real-world examples of exceptional-condition vulnerabilities

Frequently asked questions