OWASP Top 10 in Practice
Work through the OWASP Top 10 (2021) with a focus on broken access control, injection, XSS, authentication failures, misconfiguration and SSRF. You will probe a fictional training application and learn the code-level fix for every weakness you find.
- Level
- Intermediate
- Study time
- 9 hours
- Lessons
- 4
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Name the OWASP Top 10 2021 categories and map a described flaw to the correct category
- Identify an IDOR / broken access control pattern from access logs and state the server-side fix
- Detect SQL injection and command injection from application responses and recommend parameterised queries and shell-free execution
- Explain reflected, stored and DOM XSS and apply context-aware output encoding
- Recognise authentication, session, misconfiguration and SSRF weaknesses and propose controls
Before you start
Basic understanding of HTTP (methods, status codes, cookies) and some programming experience
Tools you will use
Course outline
4 lessons in 2 modules.
Module 1: Access control and injection
- The OWASP Top 10 and broken access control
- Injection: SQL and command injection
Module 2: Client-side, authentication and server-side risks
- Cross-site scripting and output encoding
- Authentication failures, misconfiguration and SSRF
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Spot the invoice enumeration Beginner, 25 min
- Find the SQL injection Intermediate, 35 min
- Chain the findings Advanced, 45 min, final lab
2 assessments
- OWASP Top 10 knowledge check
- OWASP Top 10 final quiz
The pass mark is 70%. You can retake an assessment.