The OWASP Top 10 is the industry's list of the most critical web application security risks. Reading about them helps; exploiting them is what makes them stick. Below is each risk in plain English, with a free lab in the Web Pentesting course where you attack it against a real, deliberately vulnerable app in your browser.
1. Broken access control
When the app does not check that you are allowed to see or do something - for example reading another user's record by changing an id (IDOR). Lab: Read someone else's note.
2. Cryptographic failures & token security
Weak or trusted-by-the-client tokens let attackers forge identities. Lab: Forge an admin JWT.
3. Injection
Untrusted input changes the meaning of a query or command. Labs: SQL injection to log in as admin and command injection. Reflected input in the page is cross-site scripting (XSS).
4. Insecure design & business logic
Flaws in the rules themselves, not the code. Lab: get paid by the store with a negative quantity.
5. Security misconfiguration
Dangerous defaults and exposed features - like an XXE-enabled XML parser. Lab: read an internal file with XXE.
6. Vulnerable components & file uploads
Trusting what users send, such as an upload filename. Lab: escape the uploads directory.
7. Authentication failures
Weak passwords and no rate limiting. Lab: brute-force the weak account.
8. Software & data integrity (insecure deserialization)
Trusting serialized data from the client. Lab: run code through the prefs cookie.
9. Server-side request forgery (SSRF)
Making the server fetch a URL you choose, reaching internal services. Lab: pivot to the internal admin API.
10. Server-side template injection & more
Injecting into a server template to run code. Lab: execute code through the greeting. The full course also covers CSRF, CORS, open redirects, request smuggling, cache poisoning, GraphQL and clickjacking.
Learn it by doing
Start the free Web Pentesting course - no Kali, no Burp, no setup. Everything runs against a safe target in your browser.