My Skill Lab
CybersecurityIntermediate

Web Application Security (OWASP Top 10)

Find and fix the flaws attackers exploit most.

Taught by Prabin Shrestha · Application Security Engineer

What you'll learn

  • Read and apply the OWASP Top 10 to triage and prioritise real vulnerabilities by impact and likelihood
  • Prevent injection and SQLi by using parameterised queries, safe ORMs, and strict input validation
  • Stop XSS with context-aware output encoding, a strong Content Security Policy, and trusted templating
  • Design robust authentication, session management, and CSRF protections that resist common attacks
  • Enforce server-side access control and eliminate IDOR and privilege-escalation bugs
  • Set up a legal, consent-based practice lab and follow responsible-disclosure norms

About this course

Learn to recognise, prevent, and remediate the vulnerabilities that account for the overwhelming majority of real-world web breaches. This course walks you through the OWASP Top 10 from a defender's chair, pairing clear threat models with concrete secure-coding patterns you can apply the same day. Every offensive concept is taught only so you can build stronger defences, and every hands-on task is scoped to your own lab and deliberately vulnerable practice apps.

Course content

8 lessons
  1. 1The OWASP Top 10 and How to Think Like a DefenderWhat the Top 10 is, how to read it, and the mindset that finds and fixes flaws.Preview
  2. 2Build a Legal Lab and Practise ResponsiblySet up a consent-based practice environment and learn the law and ethics of security testing.Preview
  3. 3Injection and SQL Injection: Stop Mixing Data with CodeWhy injection happens and how parameterisation, ORMs, and validation eliminate it.
  4. 4Cross-Site Scripting (XSS): Encode, Sanitise, and Lock DownThe three XSS types and how output encoding, CSP, and safe templating defeat them.
  5. 5Authentication and Session Management Done RightProtect credentials, sessions, and tokens against the most common takeover techniques.
  6. 6Cross-Site Request Forgery (CSRF): Prove the Request Was IntendedHow forged cross-site requests work and how tokens and SameSite cookies stop them.
  7. 7Broken Access Control and IDOR: Enforce Authorisation Server-SideWhy access-control bugs top the list and how to enforce least privilege correctly.
  8. 8Input Validation, Secure Defaults, and Shipping Secure CodeTie it together with validation, configuration, dependencies, and a secure SDLC habit.