🛡️ OWASP Top 10 Labs

Hands-on offensive security research mapped to OWASP Top 10 (2025 — latest release).

Hands-on OWASP Top 10 exploitation and bug bounty learning

📚 What is OWASP Top 10?

The OWASP Top 10 is a globally recognized list of the most critical web application security risks published by the Open Worldwide Application Security Project (OWASP). It helps developers, security engineers, and researchers understand the most common attack vectors affecting modern applications.

This project documents hands-on exploitation of these vulnerabilities through practical labs, focusing on real-world impact and offensive security learning.

OWASP Top 10 (2025)

A01 — Broken Access Control
A02 — Security Misconfiguration
A03 — Software Supply Chain Failures
A04 — Cryptographic Failures
A05 — Injection
A06 — Insecure Design
A07 — Identification & Authentication Failures
A08 — Software & Data Integrity Failures
A09 — Security Logging & Monitoring Failures
A10 — Server-Side Request Forgery (SSRF)

🔥 Labs

A01 — Broken Access Control

IDOR exploitation via API manipulation.

A02 — Security Misconfiguration

Exposed backups, stack traces and configuration leaks.

A05 — Injection (Stored XSS)

Persistent JavaScript injection via DVWA.

A05 — Injection (SQL Injection)

Union-based SQLi with hash extraction and cracking.

A07 — Authentication Failures

Privilege escalation using forged JWT tokens.

A10 — Server-Side Request Forgery

Backend route injection and stack trace leakage.

🎯 Goal

Build real-world vulnerability intuition and transition into bug bounty hunting.

⚠️ Disclaimer

All labs performed in controlled environments for educational purposes.