OWASP Top 10: Essential Web Application Security Risks
$99.00
Learn the OWASP Top 10 web application security risks and how to spot and reduce each one. 1 hour 7 minutes over 13 videos, plus 30 test questions.
- Login details sent straight after payment
- Self-paced. Study on any device
- StemBoss Certificate of Completion
- 14-day refund promise
Secure checkout. Pay by card, Apple Pay or Google Pay.
OWASP Top 10: Essential Web Application Security Risks walks through the ten most common web application security risks listed by OWASP, the Open Worldwide Application Security Project. It is for web developers, security analysts and IT managers who want a practical base in web app security. The course runs for 1 hour 7 minutes across 13 videos, with 30 test questions.
What you will learn
- What the OWASP Top 10 is and why it matters
- How to recognise threats to web applications and APIs
- How injection and cross-site scripting (XSS) attacks work
- How to review authentication, sessions and access control
- Why input validation and safe configuration matter
- The risks of insecure deserialisation and vulnerable components
- How to plan logging and monitoring so attacks are seen in time
- How to rank fixes by risk
Course outline
- What is OWASP: an introduction to the OWASP Top 10
- Top 10 web application security risks: injection, broken authentication, sensitive data exposure, XML external entities (XXE), broken access control, security misconfiguration, cross-site scripting, insecure deserialisation, using components with known weaknesses, and poor logging and monitoring
The risks follow the 2017 edition of the OWASP Top 10. OWASP updates its list from time to time, most recently in 2025, and has merged or renamed some categories since, but the core issues covered here are still found in web applications today.
Who this course is for
- Web developers who want to write safer code
- Security analysts and penetration testers
- IT managers responsible for web applications
- Anyone moving into cybersecurity who wants a practical start in web app risk
Before you start
You do not need advanced credentials. You should know the basics of how web applications work, including HTTP requests, cookies and sessions.
Jobs this course supports
- Web application security engineer
- Cybersecurity analyst
- Penetration tester
- Security consultant
- IT security manager
- Secure software developer
| Skill level | Intermediate |
|---|---|
| Duration | 1 Hours 7 Minutes |
| Videos | 13 Course Videos |
| Questions | 30 Test Questions |
| Prerequisites | Basic knowledge of how web applications work, including HTTP, cookies and sessions. |
| Best for | Web developers, security analysts, penetration testers, IT managers, people moving into cybersecurity |
| Topics covered | Injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialisation |
| Format | Online video lessons, self-paced |
| Language | English |
| Closed captions | Yes |
| Certificate | StemBoss Certificate of Completion |
What is inside this course
2 modules and 13 lessons. Here is the full outline.
Module 1 - What Is OSWASP1 lessons
- Module 1.1 - Introduction to OSWASP Top 10
Module 2 - Top 10 Web Application Security Risks12 lessons
- Module 2.1 - Overview of Risks We Will Explore
- Module 2.2 - Injection
- Module 2.3 - Broken Authentication
- Module 2.4 - Sensitive Data Exposure
- Module 2.5 - XML External Entities (XXE)
- Module 2.6 - Broken Access Control
- Module 2.7 - Security Misconfiguration
- Module 2.8 - Cross-Site Scripting XSS
- Module 2.9 - Insecure Deserialization
- Module 2.10 - Using Vulnerable Components
- Module 2.11 - Insufficient Logging and Monitoring
- Module 2.12 - Course Conclusion
Your learning path
Where OWASP Top 10: Essential Web Application Security Risks fits. Build your skills one step at a time.
Frequently asked questions
What is the OWASP Top 10?
It is a list of the most critical web application security risks, published by OWASP, the Open Worldwide Application Security Project. Developers and security teams use it as a starting point for secure design and testing.
Which edition of the OWASP Top 10 does this course follow?
The risks in the course follow the 2017 edition. Later editions, most recently 2025, merge or rename some categories, but the same core issues remain.
Is this course useful for developers as well as security staff?
Yes. It is built for developers who want to write safer code, as well as analysts, testers and IT managers.
What should I know before starting?
You should understand the basics of web applications, such as HTTP requests, cookies and sessions.
Do I get a certificate?
Yes. You get a StemBoss Certificate of Completion when you finish the course.
Can I get a refund?
Yes, within 14 days if you have completed less than 20% of the course. See our refund policy for details. Read the refund policy.
