Course Modules
Module 10: Mishandling of Exceptional Conditions (OWASP A10:2025)
A leaked resource pool, a leaked stack trace, and a transfer that corrupts balances when it crashes mid-way.
Course Modules
Course Modules
Module 9: Security Logging Failures (OWASP A09:2025)
The same brute-force attack, invisible with no logging — caught live with structured logs and a watcher script.
Course Modules
Module 8: Software/Data Integrity Failures (OWASP A08:2025)
Remote code execution via pickle.loads() on a client-controlled cookie — exploit it, then fix it with signed JSON.
Course Modules
Module 7: Authentication Failures (OWASP A07:2025)
Credential-stuff a login page, then stop it with rate limiting and a breach-password check.
Course Modules
Module 6: Insecure Design (OWASP A06:2025)
A missing server-side purchase cap and a brute-forceable security question — two business-logic flaws with no code "bug" required.
Course Modules
Module 5: Injection (OWASP A05:2025)
SQL injection escalating to OS command injection in one intranet app — exploit, patch, and re-test.
Course Modules
Module 4: Cryptographic Failures (OWASP A04:2025)
Steal a session cookie over a man-in-the-middle proxy, then fix it with HTTPS, Argon2id and cookie flags.
Course Modules
Module 3: Software Supply Chain Failures (OWASP A03:2025)
A malicious npm postinstall script exfiltrates a secret — catch it with an SBOM and a grep, then prevent it…
Course Modules
Module 2: Security Misconfiguration (OWASP A02:2025)
Directory listing, exposed admin console, default creds and verbose errors in one stack — find them, fix them, verify with…
Course Modules
Module 1: Broken Access Control (OWASP A01:2025)
IDOR and forced browsing in a notes app — exploit it, fix it with ownership checks and a role decorator,…