OWASP TOP 10 · 2025

Hands-On Security Labs

Hands-on, practical labs to build real cybersecurity skills: concept, setup, exploitation, detection, and fix. Every OWASP Top 10:2025 category, one self-contained interactive playground each — no setup required, safe to demo live.

A01

Broken Access Control

IDOR playground — hijack another user's data by editing an ID.

A02

Security Misconfiguration

See exactly what a misconfigured production server leaks.

A03

Software Supply Chain Failures

Watch a malicious npm package slip through an install.

A04

Cryptographic Failures

A weak hash cracks instantly while a modern one resists.

A05

Injection

Send a crafted input and see an injection succeed or get blocked.

A06

Insecure Design

A flawed business-logic flow with no safe design to fall back on.

A07

Authentication Failures

Credential stuffing succeeds, until MFA and lockout stop it.

A08

Software or Data Integrity Failures

An unsigned auto-update gets accepted blindly.

A09

Logging & Alerting Failures

An attack sails through a SOC log feed completely unnoticed.

A10

Mishandling of Exceptional Conditions

A wallet transfer bypasses authorization when an error is mishandled.

PRACTICAL LAB TRACK

Phishing & Email Security

Learn to read raw headers, verify SPF/DKIM/DMARC, and spot a spoofed sender — from foundations to a full incident-style investigation.

BASIC

Phishing Email Analysis — Basics

How email travels, ports, SPF/DKIM/DMARC, and a real sanitized phishing email to analyze.

MEDIUM

Header Forensics & Spoofing

Deeper header forensics and spoofing techniques.

HARD

Business Email Compromise Investigation

Full BEC-style incident investigation, start to finish.