Web security education · Interactive
The ten most critical web vulnerabilities. Learn them by breaking them.
An interactive playground for the OWASP Top 10. Run the attacks yourself, understand why they work, then compare against the patched version. Everything runs safely inside your browser, with no real server harmed.
01
What is the OWASP Top 10?
A list of the ten most critical web application security risks, built from data across thousands of real applications. It's the standard reference for developers and pentesters worldwide.
02
Learn by doing
Theory you only read fades fast. Here you enter the payload, watch the exploit work, then prove for yourself why the fixed version holds up.
03
A sandbox, not a target
There's no real vulnerable backend. Every simulation runs client-side, so you're free to experiment with zero risk.
Index
10 of 10 available01Broken Access ControlA01Access rules aren't properly enforced, letting users do things that should be outside their permissions.02Cryptographic FailuresA02Sensitive data isn't protected because cryptography is weak, misused, or missing altogether.03InjectionA03Untrusted data is slipped into an interpreter (SQL, OS commands, and so on), changing what the code was meant to do.04Insecure DesignA04A fundamental weakness in how the system is designed, not just a bug in the implementation.05Security MisconfigurationA05Wrong security settings, defaults left unchanged, or risky features enabled without a reason.06Vulnerable and Outdated ComponentsA06Using libraries or components with known vulnerabilities or that are no longer maintained.07Identification and Authentication FailuresA07Weaknesses in verifying user identity: weak passwords, leaked sessions, or unlimited brute-force attempts.08Software and Data Integrity FailuresA08Failing to verify the integrity of software, updates, or data, for example in CI/CD pipelines and unsafe deserialization.09Security Logging and Monitoring FailuresA09Insufficient logging and monitoring lets attacks slip past detection and delays incident response.10Server-Side Request Forgery (SSRF)A10The server is tricked into sending requests to a destination the attacker chooses, crossing internal network boundaries.