Application Security
for Developers
Run the exploit in a real browser against a deliberately vulnerable app, then write the fix that stops it.
22 hands-on exercises across the OWASP Top 10 for web applications. Free to play, no sign-up required.
OWASP Top 10 for Web Applications
Clickjacking
Steal a click on a bank approval button.
- Overlay a transparent iframe
- Capture a real approval
- Ship CSP frame-ancestors
Command Injection
Chain a second command onto a server-side tool.
- Tamper a captured request
- Watch server secrets leak
- Ship argument-list execution
Components with Known Vulnerabilities
Get code execution through an outdated library.
- Exploit a published CVE
- Run commands via a crafted upload
- Bump the version and scan in CI
Cross-Site Request Forgery
Move money from a page the victim never trusted.
- Auto-post a cross-site transfer
- See why cookies ride along
- Add per-session tokens and SameSite
Directory Traversal
Read system files through a download link.
- Escape the intended folder
- Pull /etc/passwd from the server
- Canonicalise, then verify
DOM XSS
Trigger XSS the server never sees.
- Hide a payload in the URL hash
- Trace an unsafe innerHTML sink
- Swap to textContent
Forced Browsing
Pull an employee PII export from an unlinked route.
- Reach an "internal" URL anonymously
- See why obscurity is not access control
- Enforce auth server-side
Horizontal Privilege Escalation
Change one digit and read another customer.
- Walk an IDOR from both sides
- Enumerate sequential record ids
- Add the missing ownership check
Host Header Injection
Redirect a password-reset email to a lookalike domain.
- Forge the X-Forwarded-Host header
- Steal the clicked reset token
- Pin a configured base URL
Insecure URL Redirect
Hide a phishing page behind a real login.
- Abuse the next parameter
- See why the domain looks right
- Allow relative targets only
Leftover Debug Code
Pull production secrets from a forgotten debug route.
- Find an env-dumping endpoint
- Read JWT and database secrets
- Fail closed with an allow-list
PII in URL
Lift personal data straight out of a link.
- Spot identifiers in query strings
- Follow the leak into logs and referrers
- Rewrite to opaque tokens
Reflected XSS
Craft a malicious URL that runs the moment it opens.
- Reflect a payload off a search page
- Understand the victim-clicks-link flow
- Escape at the render boundary
Server-Side Request Forgery
Make the server fetch its own cloud credentials.
- Abuse a link-preview feature
- Reach the metadata endpoint
- Validate outbound destinations
Session Fixation
Plant a session id and inherit the victim login.
- Fix a known id on the victim
- Watch login reuse it
- Regenerate on every login
SQL Injection
Dump a database through one unguarded lookup form.
- Exploit a tautology payload
- Exfiltrate tables with UNION SELECT
- Ship the parameterized fix
Stored XSS
Plant a script in a comment and watch it fire.
- Store a payload in user content
- See it execute for the next visitor
- Escape output at render time
Token Exposure in URL
Replay a session token harvested from a referrer log.
- Catch a token in a redirect URL
- Replay it into a live account
- Move it to an HttpOnly cookie
User Enumeration
Harvest a verified customer list from a login form.
- Read differing error bodies
- Measure response-time leaks
- Unify errors and timing
Vertical Privilege Escalation
Forge a role claim and become an administrator.
- Tamper the session token
- Jump from viewer to admin
- Verify tokens before trusting them
Weak Randomness
Predict a password-reset token and take the account.
- Sample tokens from the generator
- Recover Math.random() state
- Move to crypto.randomBytes
XXE Injection
Read the password file through an XML upload.
- Submit a crafted purchase order
- Resolve an external entity
- Disable entity resolution
Frequently Asked Questions
What is application security training?
Application security training teaches developers to find and fix the vulnerability classes that attackers actually exploit, such as injection, broken access control, and cross-site scripting. It targets the people writing the code, not the general workforce.
Every exercise here puts you in a simulated workstation with a real browser and a deliberately vulnerable web app. You run the attack yourself, then apply the secure pattern that closes it.
Which OWASP Top 10 risks do these exercises cover?
The course spans injection (SQL and command), broken access control (horizontal and vertical privilege escalation, forced browsing), cryptographic and authentication failures (weak randomness, session fixation), and security misconfiguration (leftover debug code, vulnerable dependencies).
Cross-site scripting is covered in all three forms: stored, reflected, and DOM-based. Each exercise pairs the exploit with the remediation.
Do I need to know how to code to complete these?
Basic familiarity with web development helps, since the fixes are shown as code changes such as swapping a concatenated query for a parameterized one.
You do not need to write code from scratch. The exercises walk you through reading the vulnerable handler, spotting the bug, and reviewing the corrected version.
Does this satisfy PCI DSS secure-coding training requirements?
PCI DSS Requirement 6.2 covers secure software development, and 12.6 covers security awareness for staff. Developers who write code touching cardholder data fall under both.
These exercises provide the hands-on secure-coding component, and completion records export to your LMS through SCORM or LTI for audit evidence.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.