01. Overview & Threat Landscape
In-depth guide to the OWASP risk rating methodology, core root causes of software vulnerabilities, and CI/CD DevSecOps integration using SAST, DAST, and SCA.
02. A01: Broken Access Control & IDOR
Deep technical dive into Broken Access Control, Insecure Direct Object References (IDOR), vertical/horizontal privilege escalation, and multi-language RBAC/ABAC secure coding practices.
03. A02: Cryptographic Failures
Comprehensive guide to Cryptographic Failures: Password hashing with Argon2id/bcrypt, AES-256-GCM authenticated encryption, secret management, TLS 1.3, and key management architecture.
04. A03: Injection (SQLi, Command Injection & SSRF)
Deep technical guide to Injection flaws: SQL Injection (in-band, blind), Command Injection, and Server-Side Request Forgery (SSRF with cloud IMDS defense) across Python, Node.js, Go, and Java.
05. A04 & A05: Insecure Design & Security Misconfiguration
In-depth guide to Insecure Design and Security Misconfiguration: Rate limiting, CORS policies, XML External Entity (XXE) prevention, security headers, and safe defaults.
06. Defenses & Secure Coding Cheatsheet
Cross-language defense matrix (Python, Node.js, Go, Java), production Semgrep SAST rule set, and pull request security review checklist.
07. Hands-On Vulnerability Lab
Self-contained, runnable Python laboratory featuring a vulnerable Flask API, automated exploit suite (IDOR, SQLi, SSRF), and verified secure fixes.
08. References & Tooling
Authoritative security standards (NIST, ASVS, WSTG, PCI-DSS), SAST/DAST scanner matrix, and notable CVE case study references.
OWASP Top 10 Deep Dive
Comprehensive guide to the OWASP Top 10 web application security risks, detailing root causes, multi-language code vulnerabilities, automated SAST/DAST defenses, and hands-on labs.