Recommended Path (Hands-On Only): Compliance

Foundational: HackEDU: OWASP API Top 10

Learn about the 10 most common threats to web API's.

Hands-On Only | Total Learning Path Duration: 2 hours 30 minutes

Broken Object Level Authorization (2023) (HackEDU)

Broken Authentication (HackEDU)

Broken Object Property Level Authorization (HackEDU)

Unrestricted Resource Consumption (HackEDU)

Broken Function Level Authorization (2023) (HackEDU)

Unrestricted Access to Sensitive Business Flows (HackEDU)

Server-Side Request Forgery (SSRF) (HackEDU)

API: Security Misconfiguration (HackEDU)

Improper Inventory Managment (HackEDU)

Unsafe Consumption of APIs (HackEDU)

Foundational: HackEDU: OWASP Top 10: 2021

Learn about the 10 most common threats to web applications.

Hands-On Only | Total Learning Path Duration: 4 hours 15 minutes

Broken Access Control (HackEDU)

Cryptographic Failures (HackEDU)

SQL Injection: Part 1 (HackEDU)

SQL Injection: Part 2 (HackEDU)

SQL Injection: Part 3 (HackEDU)

Reflected Cross-Site Scripting (XSS) (HackEDU)

Stored Cross-Site Scripting (XSS) (HackEDU)

DOM-Based Cross-Site Scripting (XSS) (HackEDU)

Command Injection (HackEDU)

Insecure Design (HackEDU)

Security Misconfiguration (HackEDU)

XML External Entities (HackEDU)

Vulnerable and Outdated Components (HackEDU)

Identification and Authentication Failures (HackEDU)

Software and Data Integrity Failures (HackEDU)

Security Logging and Monitoring Failures (HackEDU)

Server-Side Request Forgery (SSRF) (HackEDU)

Foundational: HackEDU: OWASP Top 10: 2021 | Alt 1

This resource collection provides comprehensive lessons on critical security principles and enhances the standard OWASP Top Ten list with alternative lessons addressing new Common Weakness Enumerations and innovative solutions to fortify applications against attackers.

Hands-On Only | Total Learning Path Duration: 3 hours 15 minutes

Cryptographic Failures | Use of Hard-coded Password (Part 1) (HackEDU)

Cryptographic Failures | Use of Hard-coded Password (Part 2) (HackEDU)

Injection | Command Injection (HackEDU)

Injection | SQL Injection (HackEDU)

Cross-Site Scripting (Reflected XSS) | Improper Web Page Input Neutralization (HackEDU)

Insecure Design | Incorrect Privilege Assignment (HackEDU)

Security Misconfigurations | Error Message Containing Sensitive Information (HackEDU)

XML External Entities (XXE) | Improper Restriction of XML External Entity (HackEDU)

Vulnerable and Outdated Components | Using Components with Known Vulnerabilities (HackEDU)

Identification and Authentication Failures | Authentication Bypass by Spoofing (HackEDU)

Software and Data Integrity Failures | Over-reliance on Cookies (HackEDU)

Security Logging and Monitoring Failures | Insufficient Logging (HackEDU)

Server-Side Request Forgery | Regex Filtering (HackEDU)