Module 4 · Hands-on defence Lesson 11 of 15
The OWASP Top 10, in plain words
The Top 10 is a list of the mistakes that keep happening: broken access control, injection, weak authentication, misconfiguration, and more. Knowing the five that hit web apps covers most real findings.
The concept
Injection is still alive in any query built by string-joining user input; parameterised queries and escaping are the fix, and reviewers look for them first.
Misconfiguration - debug mode on, directory listing on, default credentials kept - is unglamorous and extremely common. Check the settings before hunting exotic bugs.
Checklist - the five that matter most:
1. Broken access control can you change an id in the URL and see others' data?
2. Injection is input concatenated into SQL or a shell command?
3. Authentication is there rate limiting on login? MFA? session timeouts?
4. Misconfiguration debug on? directory listing? default creds left?
5. Sensitive data secrets in the repo? stack traces shown to users?
Fix order: 1 and 2 first - they are exploited the most.Worked example
A page that shows /invoice/1042 and lets you open /invoice/1043 by changing the number is broken access control - the most common serious flaw.
Your practice task
Take one web app and check three things: can you change an ID and see someone else data, is input reflected into the page, are errors leaking stack traces.
Do this before moving on. Reading a solution teaches the shape of it; typing it teaches you.
Key takeaway
Injection is still alive in any query built by string-joining user input; parameterised queries and escaping are the fix, and reviewers look for them first.
Keep your place in this course
A free account saves which lessons you have finished and unlocks the certificate. The lesson itself stays free to read.
Create free account or sign inCourse complete
You finished every lesson.
Your certificate is ready, and the projects you built are the proof to attach to an application.
Almost there
15 lessons left of 15
Finish every lesson to unlock the certificate. Each one ends in a practice task — do them and the final project brief writes itself.