SELECT A LESSON TO BEGIN
Learn to find and fix the ten web-app flaws responsible for most real-world breaches.
Developers who want to stop shipping the same bugs, and aspiring web pentesters learning what to hunt for.
Not a timed exam — a hands-on web-security track mapped to the OWASP Top 10 (2025), with ASVS and the Web Security Testing Guide woven in.
Three tasters — the real track has hundreds, graded, with full rationale.
B. Directly referencing an object by id with no authorisation check is an Insecure Direct Object Reference — a form of Broken Access Control, the #1 category.
B. Injecting ' OR '1'='1 tries to make the SQL WHERE clause always true, bypassing authentication. It is the canonical first SQLi probe.
B. XSS is an output problem: encoding/escaping user data for the context it is rendered in stops the browser from executing it as script. HTTPS protects transport, not rendering.
The full OWASP Top 10 track — lectures, graded checks and labs — is free to start. Create an account to save your progress, earn points and climb the leaderboard.