OWASP Top 10 Simulator

An interactive learning platform for mastering the OWASP Top 10 risks.

About The Project

This project is inspired by the OWASP Top 10 for Web Applications and APIs. It aims to be a valuable, hands-on resource for professionals, students, and educators in the AppSec and Cybersecurity space.

Whether you're looking to visually understand these critical risks for the first time, or a seasoned professional wanting to practice and keep your knowledge up-to-date, this simulator provides a safe, interactive environment to learn and experiment.

Compiled with for APPSec by Caleb Eghan

Select a tab below to explore the interactive simulations for each category.

A01: Broken Access Control

Accessing data and functionality you are not authorized to see.

A02: Cryptographic Failures

Sensitive data exposure due to weak or missing encryption.

A03: Injection

Exploiting vulnerabilities to execute unintended commands.

A04: Insecure Design

Flaws in the application architecture and design process.

A05: Security Misconfiguration

Improperly configured security settings or verbose errors.

A06: Vulnerable Components

Using libraries or frameworks with known vulnerabilities.

A07: Auth Failures

Weaknesses in session management and credential handling.

A08: Data Integrity Failures

Failures related to insecure deserialization or data validation.

A09: Logging & Monitoring Failures

Insufficient logging to detect and respond to attacks.

A10: Server-Side Request Forgery

Forcing the server to make requests to unintended locations.