OWASP TOP 10: 2025

The OWASP Top 10 is not just a simple checklist of vulnerabilities, but a collection of attack vectors through which a web application might be compromised

1. A01:2025 – Broken Access Control

• Access control

• LFI

• SSRF

• File upload

1. A02:2025 – Security Misconfiguration

• XXE

• CORS

• HTTP Host Header attacks

• Informational disclosure

1. A03:2025 – Software Supply Chain Failures

• Insecure Deserialization

• Prototype Pollution

1. A04:2025 – Cryptographic Failures

• Information Disclosure

• Authentication

• JWT attacks

1. A05:2025 – Injection

• SQL injection

• XSS

• Comand Injection

• NoSQL injection

• SSTI

1. A06:2025 – Insecure Design

• Business Logic Vuln

• Race Conditions

• Web LLM

1. A07:2025 – Authentication Failures

• Authentication

• OAuth

• JWT attacks

1. A08:2025 – Software or Data Integrity Failures

• Insecure Deserialization

• Web Cache Poisoning

1. A09:2025 – Security Logging and Alerting Failures This is largely a process/defensive failure rather than a specific "exploit" you can practice in a lab. However, Information disclosure labs often rely on verbose error logging which should have been alerted on or suppressed.

2. A10:2025 – Mishandling of Exceptional Conditions

• Information Disclosure

• Business Logic vuln

• API testing