OWASP Top 10
The OWASP Top 10 is an awareness guide to the most critical risks in web applications. It gives developers, testers, and security teams a shared way to recognize and reduce common classes of security failure.
itOffensive security and application security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
OWASP Top 10
The OWASP Top 10 is an awareness document for web application security. It is not a scanner, a compliance certificate, or a complete security program. It gives a team a common map of risk categories, so security work starts with the right questions.
The current release is OWASP Top 10:2025. It groups web application weaknesses into ten categories. A category collects related failure modes rather than naming one exploit. Broken access control, for example, covers failures where a user can act outside the permissions the application intended to grant.
Use the Top 10 to frame design reviews, code review, testing, remediation planning, and training. Then move from the category to concrete requirements and tests. OWASP ASVS defines verification requirements. The Web Security Testing Guide organizes testing. The Cheat Sheet Series gives focused implementation guidance.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://owasp.org/www-project-top-ten/
Supports
- OWASP Top 10 as a standard awareness document and broad consensus on critical web application risks
- Current released version is OWASP Top 10:2025
- https://owasp.org/Top10/2025/
Supports
- Current 2025 release and complete list of ten categories
- OWASP Top 10 as an awareness document for developers and web application security
- https://owasp.org/Top10/2025/0x00_2025-Introduction/
Supports
- 2025 category names and changes
- Data-informed methodology supplemented by community survey input
- Categories as groups of CWEs and emphasis on root causes
- https://owasp.org/Top10/2025/
Supports
- Official navigation to the ten category pages and category-specific prevention guidance
- https://owasp.org/www-project-application-security-verification-standard/
Supports
- ASVS as a framework of security requirements for designing, developing, and testing web applications and web services
- https://owasp.org/www-project-web-security-testing-guide/
Supports
- Web Security Testing Guide as an OWASP testing resource
- https://owasp.org/www-project-cheat-sheets/
Supports
- Cheat Sheet Series as concise good-practice guidance for application developers
- https://github.com/paragonie/awesome-appsec
Supports
- Curated discovery of Juice Shop, NodeGoat, and SecurityHeaders.com as application security learning and assessment resources