🔐 OWASP Top 10 Labs — Hands-On Web Application Security

Practical, hands-on labs for every OWASP Top 10 (2021) vulnerability — with exploitation steps, detection logic, and remediation code.

Built by Adarsh Singh | GitHub: @SecurityWithAdarsh

---

📌 What Is This Repo?

This repository contains 10 structured lab modules, one per OWASP Top 10 (2021) vulnerability category. Each lab includes:

• 📖 Concept — What the vulnerability is and why it exists
• 🧪 Lab Setup — Environment, prerequisites, target application
• ⚔️ Attack Walkthrough — Step-by-step exploitation with commands
• 🔍 Detection — Log patterns, Burp Suite tips, SIEM queries
• 🛡️ Remediation — Secure code snippets and hardening guidance
• 🗺️ MITRE ATT&CK Mapping — Mapped to relevant techniques

All labs use legal, intentionally vulnerable applications (DVWA, OWASP WebGoat, OWASP Juice Shop, HackTheBox).

---

🗂️ Repository Structure

OWASP-Top10-Labs/
├── labs/
│   ├── A01-Broken-Access-Control/
│   ├── A02-Cryptographic-Failures/
│   ├── A03-Injection/
│   ├── A04-Insecure-Design/
│   ├── A05-Security-Misconfiguration/
│   ├── A06-Vulnerable-Components/
│   ├── A07-Identification-Authentication-Failures/
│   ├── A08-Software-Data-Integrity-Failures/
│   ├── A09-Security-Logging-Monitoring-Failures/
│   └── A10-SSRF/
├── dvwa-labs/              # DVWA-specific walkthroughs
├── tools/                  # Helper scripts (Python, Bash)
├── checklists/             # Quick pentest checklists per category
├── reports/                # Sample pentest report templates
└── README.md

---

📋 Lab Index

#	OWASP ID	Vulnerability	Platform	Difficulty	Status
1	A01:2021	Broken Access Control	DVWA + WebGoat	🟢 Beginner	✅ Complete
2	A02:2021	Cryptographic Failures	DVWA + Custom	🟡 Intermediate	✅ Complete
3	A03:2021	Injection (SQLi + XSS + CMDi)	DVWA + SQLMap	🟢 Beginner	✅ Complete
4	A04:2021	Insecure Design	Juice Shop	🟡 Intermediate	✅ Complete
5	A05:2021	Security Misconfiguration	Custom + Nikto	🟢 Beginner	✅ Complete
6	A06:2021	Vulnerable & Outdated Components	Custom + CVE	🟡 Intermediate	✅ Complete
7	A07:2021	Identification & Auth Failures	DVWA + Burp	🟢 Beginner	✅ Complete
8	A08:2021	Software & Data Integrity Failures	Custom + JWT	🔴 Advanced	✅ Complete
9	A09:2021	Security Logging & Monitoring Failures	Splunk + DVWA	🟡 Intermediate	✅ Complete
10	A10:2021	Server-Side Request Forgery (SSRF)	WebGoat + Custom	🔴 Advanced	✅ Complete

---

🛠️ Lab Environment Setup

Option 1: DVWA (Recommended for A01, A02, A03, A07)

# Using Docker (easiest)
docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwa

# Access at http://localhost/
# Default credentials: admin / password
# Set Security Level: Low (start), Medium, High as you progress

Option 2: OWASP Juice Shop (A04, A05)

docker pull bkimminich/juice-shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# Access at http://localhost:3000

Option 3: OWASP WebGoat (A01, A08, A10)

docker pull webgoat/webgoat
docker run -d -p 8080:8080 -p 9090:9090 webgoat/webgoat
# Access at http://localhost:8080/WebGoat

Required Tools

# Burp Suite Community Edition
https://portswigger.net/burp/communitydownload

# SQLMap
pip install sqlmap
# or: sudo apt install sqlmap

# FFUF (Fuzzer)
go install github.com/ffuf/ffuf/v2@latest
# or: sudo apt install ffuf

# Nikto
sudo apt install nikto

# Python 3 (for helper scripts)
sudo apt install python3 python3-pip

---

🎯 How to Use These Labs

1. Start with A03 (Injection) — Most visible, builds confidence
2. Follow the order A01 → A10 for structured learning
3. Each lab has Low / Medium / High difficulty progressions (DVWA security levels)
4. Complete the detection section — This is what makes you stand out in SOC/AppSec interviews
5. Read the remediation code — Understand what secure looks like

---

🧰 Tools Used Across Labs

Tool	Purpose	Labs
Burp Suite Community	HTTP interception, fuzzing, repeater	A01, A02, A07, A08, A10
SQLMap	Automated SQL injection	A03
FFUF	Directory/path fuzzing	A01, A05
Nikto	Web server misconfiguration scan	A05
jwt.io	JWT token analysis	A08
CyberChef	Decoding, hashing, crypto analysis	A02
Python (requests)	Custom exploit scripts	A03, A10
Splunk (free tier)	Log analysis & detection	A09

---

🗺️ MITRE ATT&CK for Web — Coverage Map

OWASP ID	ATT&CK Technique	Tactic
A01	T1548 — Abuse Elevation Control Mechanism	Privilege Escalation
A02	T1552 — Unsecured Credentials	Credential Access
A03	T1190 — Exploit Public-Facing Application	Initial Access
A04	T1068 — Exploitation for Privilege Escalation	Privilege Escalation
A05	T1592 — Gather Victim Host Information	Reconnaissance
A06	T1190 — Exploit Public-Facing Application	Initial Access
A07	T1110 — Brute Force	Credential Access
A08	T1195 — Supply Chain Compromise	Initial Access
A09	T1562 — Impair Defenses	Defense Evasion
A10	T1090 — Proxy	Command & Control

---

📝 Sample Report Template

A professional pentest report template (based on real-world format) is in /reports/OWASP-Pentest-Report-Template.md.

---

📚 Learning Path

Beginner Path:
A03 (SQLi) → A07 (Auth) → A01 (Access Control) → A05 (Misconfig)

Intermediate Path:
A02 (Crypto) → A04 (Design) → A06 (Components) → A09 (Logging)

Advanced Path:
A08 (Integrity / JWT) → A10 (SSRF)

---

🔗 Related Resources

• OWASP Top 10 Official (2021)
• DVWA GitHub
• PortSwigger Web Security Academy
• TryHackMe — OWASP Top 10 Room
• HackTheBox — Web Challenges

---

👤 About the Author

Adarsh Singh — DevSecOps Engineer | AppSec | OT/ICS Security

• 🔗 LinkedIn
• 🐙 GitHub
• 🎯 TryHackMe: Top 5% Global
• 📧 Open to SOC Analyst, Penetration Testing, and AppSec opportunities

---

⚠️ Legal Disclaimer

All labs in this repository use intentionally vulnerable, legal practice platforms (DVWA, WebGoat, Juice Shop, HackTheBox). Never perform these techniques on systems you do not own or have explicit written permission to test. Unauthorized testing is illegal.

---

⭐ Star this repo if it helped you — and connect on LinkedIn!