AppSec Lab DEMO
Sign in Create account

OWASP Top 10:2025

Learn to break code. And to fix it.

309 interactive lessons in 18 technologies. You try the attack in a simulator, find the vulnerable line and choose how to fix it.

Start for free How it works
SQL injection in a user search · PHP
  1. 1. Attacker input ' OR '1'='1
  2. 2. The code concatenates it … WHERE name = '' OR '1'='1'
  3. 3. Result The query returns every user.

Vulnerable

12$q = $_GET['name'];13$sql = "SELECT * FROM users14  WHERE name = '$q'";15$rows = $db->query($sql);

Fixed

13$st = $db->prepare('… name = ?');14$st->execute([$q]);
lessons
309
OWASP categories
10
technologies
18
final labs
10

Four steps. Every lesson.

The same path for every vulnerability, from the input to the fix. No hours of theory before you touch anything.

  1. 1

    Understand

    A real case and a comic panel explain what happened and why.

  2. 2

    Try it

    Type an input into the simulator and look at the vulnerable and the fixed code.

  3. 3

    Practice

    One-minute exercises: spot the line, put the steps in order, pick the fix. You earn XP.

  4. 4

    Prove it

    Each category ends with a timed quiz and a final lab.

Everything you need to learn for real

Final labs

10 made-up stores, apps and dashboards. You explore, find the flaw and get a report of what you did.

  • TecShop
  • LaCesta
  • Cometa
  • Cuadra
  • and 6 more

100% simulated

No SQL, commands or network requests are run. You practice without fear of breaking anything.

Spaced review

What you get wrong comes back tomorrow. What you get right, later each time.

Paths by role

First steps in AppSec, PHP backend, Frontend, HTTP and the browser, Advanced browser security, Identity and sessions, Java and Spring, COBOL mainframe, Remote code execution on the server, DevOps and CI/CD, Cloud and supply chain, Teams using AI, Agents, MCP, and models in production, APIs and business logic, Injection beyond SQLi, Vulnerability chains.

Skills map

A placement test and a report that shows you where you're strong and what you should review.

The syllabus

Create your account to start
  • A01 Broken Access Control 63 lessons
  • A02 Security Misconfiguration 46 lessons
  • A03 Software Supply Chain Failures 29 lessons
  • A04 Cryptographic Failures 17 lessons
  • A05 Injection 76 lessons
  • A06 Insecure Design 44 lessons
  • A07 Authentication Failures 50 lessons
  • A08 Software or Data Integrity Failures 34 lessons
  • A09 Security Logging and Alerting Failures 13 lessons
  • A10 Mishandling of Exceptional Conditions 8 lessons

Plus: OWASP API Security Top 10 and OWASP Top 10 for LLM applications, in Python, JavaScript, PHP, Java, HTML, CSS, JSON, SQL, COBOL, CI/CD, Generative AI (LLM), Logs and alerts, Threat modeling, HTTP y web, Identidad y sesiones, Contenedores y Kubernetes, Nube (IAM, almacenamiento, metadatos), Formación general en IA.

For you. And for your team.

Your account

Your progress, always with you

  • Exercises solved, XP, rank and daily streak
  • Badges and a challenge board with stars
  • Review of what you got wrong and a daily challenge
  • A skills report you can print

All we ask for is a username and a password.

Create account

For trainers

Your team, under control

  • Turn on only the courses for this month
  • Open or close account sign-ups
  • Follow each person's progress
  • Browse the activity log with filters

The admin panel is turned on by whoever installs the platform, from the server.

Your first vulnerability, in five minutes

No email or personal data: a username, a password and off you go.

Start for free I already have an account