Web Top 10
One lab per category, in order.
The sets 2
API Top 10 - A6
Unrestricted access to sensitive business flows.
Also here 1
Nothing matches thatClear the filter to see everything again.
Walkthroughs against the list everybody quotes and fewer people have actually worked through.
Nothing here is a coding mistake. A wildcard CORS origin, a CSP with unsafe-inline, a Host header the app trusts, an open redirect - each is a setting that someone chose, and each one is a lever for a bigger bug rather than a finding on its own.
One lab per category, in order.
Unrestricted access to sensitive business flows.