The OWASP Top 10, condensed to what you’ll actually see

The official OWASP list is written for defenders. This is the same ten classes, reordered by what we actually trip over during labs, with a place to go practice each one.

Where to start

Broken access control and injection account for most of what shows up in a first CTF box or a first bounty report. Cryptographic failures and misconfiguration follow close behind once targets get more realistic. Start with PortSwigger’s Web Security Academy — every topic below links to one of its free labs, and it’s the closest thing this list has to a spine.

OWASP TOP 10

1. Broken access control — PortSwigger: Access control
2. Cryptographic failures — OWASP Cryptographic Storage Cheat Sheet
3. Injection — PortSwigger: SQL injection · OS command injection
4. Insecure design — OWASP Threat Modeling Cheat Sheet
5. Security misconfiguration — PortSwigger: Information disclosure
6. Vulnerable and outdated components — OWASP Vulnerable Dependency Management Cheat Sheet
7. Identification and authentication failures — PortSwigger: Authentication
8. Software and data integrity failures — PortSwigger: Insecure deserialization
9. Security logging and monitoring failures — OWASP Logging Cheat Sheet
10. Server-side request forgery — PortSwigger: SSRF

Where to practice:

• OWASP Juice Shop — a deliberately vulnerable app covering the full Top 10 in one target, good for tying the list together instead of drilling categories in isolation.
• OWASP Web Security Testing Guide — the methodology behind the labs: what to test, in what order, and how to write it up once you find something.
• OWASP Cheat Sheet Series — the defender’s-eye view of every category above. Worth reading once you’ve broken something, so you know what the fix actually looks like.

Bookmark the official OWASP project for the full detail behind each category.