OWASP Top 10:2025 — The Hands-On Course

You will learn the OWASP Top 10:2025 the only way it sticks: by breaking a small, realistic app for each category, then fixing it yourself and proving the fix holds. Every module ships a Docker lab you run on your own machine — nothing here touches a real target, and nothing requires you to trust anyone else’s server.

Who this is for

Developers, security engineers, pentesters and students who are comfortable with a terminal and basic web requests (curl, a browser’s dev tools) and want to go from "I’ve heard of IDOR/SQLi/pickle RCE" to "I’ve exploited it, fixed it, and I know what the attack looks like in a log." No prior OWASP certification or CTF experience is assumed — each module starts from the concept.

What you’ll be able to do

By the end of the course you will be able to:

Recognize each of the ten OWASP Top 10:2025 categories in real code, not just in slide decks.
Exploit a deliberately vulnerable Flask/Node app for each category, end to end.
Apply the standard fix for each category and verify it with an automated check script.
Read the logs a real attack leaves behind (or notice when there are no logs — that’s its own category).
Explain, to a teammate or in a design review, why a given pattern is risky and what to do instead.

Prerequisites

Docker Engine 20+ and Docker Compose v2 on your machine.
Basic command-line comfort: curl, reading JSON, following a README.
Python 3.9+ installed on your host (each lab ships a small lab.py helper that tracks your mission progress and runs automatic checks — it only talks to 127.0.0.1).
No cloud account, no real target, no budget required. Every lab binds to 127.0.0.1 only.

How the labs work

Each module ships one zip. Inside: a docker-compose.yml that starts a vulnerable service and a fixed (or hardened) reference service side by side, an app/ folder with the actual source so you can read and edit it, and a lab.py script with three commands:

python3 lab.py status             # see the missions for this module
python3 lab.py flag <N> <FLAG>     # submit the flag you found for mission N
python3 lab.py verify              # run automatic checks against the running lab

You exploit the vulnerable service first, submit flags as you find them, then edit the source to apply the fix and re-run verify until every check passes. The Solution for each mission is in a closed-by-default dropdown directly under the mission — read it only if you’re stuck, or to check your work.

Every lab is local-only, uses placeholder data, and is safe to run on a laptop. Clean up with docker compose down when you’re done; nothing persists outside the containers.

The module list — start here

Work through these in order; each one assumes nothing from the others, but the numbering follows the official OWASP Top 10:2025 ranking (most prevalent/impactful first).

Modules (10)

Module 1: Broken Access Control (OWASP A01:2025)

IDOR and forced browsing in a notes app — exploit it, fix it with ownership checks and a role decorator, then detect it.
Module 2: Security Misconfiguration (OWASP A02:2025)

Directory listing, exposed admin console, default creds and verbose errors in one stack — find them, fix them, verify with a checker script.
Module 3: Software Supply Chain Failures (OWASP A03:2025)

A malicious npm postinstall script exfiltrates a secret — catch it with an SBOM and a grep, then prevent it with ignore-scripts.
Module 4: Cryptographic Failures (OWASP A04:2025)

Steal a session cookie over a man-in-the-middle proxy, then fix it with HTTPS, Argon2id and cookie flags.
Module 5: Injection (OWASP A05:2025)

SQL injection escalating to OS command injection in one intranet app — exploit, patch, and re-test.
Module 6: Insecure Design (OWASP A06:2025)

A missing server-side purchase cap and a brute-forceable security question — two business-logic flaws with no code "bug" required.
Module 7: Authentication Failures (OWASP A07:2025)

Credential-stuff a login page, then stop it with rate limiting and a breach-password check.
Module 8: Software/Data Integrity Failures (OWASP A08:2025)

Remote code execution via pickle.loads() on a client-controlled cookie — exploit it, then fix it with signed JSON.
Module 9: Security Logging Failures (OWASP A09:2025)

The same brute-force attack, invisible with no logging — caught live with structured logs and a watcher script.
Module 10: Mishandling of Exceptional Conditions (OWASP A10:2025)

A leaked resource pool, a leaked stack trace, and a transfer that corrupts balances when it crashes mid-way.

Each module page follows the same shape: Learn the concept, get your scenario briefing, set up the lab, work the missions, fix the bug, re-test, then a short self-check before you move to the next module. Finish all ten and you’ll have exploited and fixed one real example of every category in the official 2025 list.

A note on the facts

Every exploit, fix, and OWASP statistic in this course is taken from the labs’ own source and the project’s published articles on this site — nothing here is invented. If a module links back to its original dhacker.in article, that’s the deeper write-up; this course page is the structured, do-it-yourself version.

Ready? Start with Module 1 — Broken Access Control.