The OWASP Top 10 is not a list to memorise. It is a map of the most consequential failure modes in web application security, drawn from real-world breach data. This module uses it as a curriculum: each week, students analyse a different vulnerability class, understand why it exists at the code and architecture level, and learn how to detect and defend against it.
Practical sessions run in a dedicated OS³ Cyber Security Lab, giving students a sandboxed environment where they can attack intentionally vulnerable systems without risk, and then build defences against those same attacks.
Why it matters
Web applications are the primary attack surface for most organisations. A developer who has never tried to exploit a SQL injection vulnerability does not fully understand why parameterised queries matter. A student who has watched a cross-site scripting attack succeed against a system they built has a different relationship with input sanitisation. This module builds that understanding by doing, not just by describing.
Module design
The module follows the OWASP Top 10 as its organising spine, moving from the highest-impact categories (broken access control, cryptographic failures, injection) through the middle tier (XSS, CSRF, misconfiguration, vulnerable components) to the harder-to-detect failures (logging gaps, SSRF). Network security closes the module, connecting web application threats to the infrastructure they run on.
Each session pairs conceptual analysis with lab work. Students do not just hear about SQL injection; they perform it against a controlled target and then write the parameterised query that would have prevented it.
Syllabus
- Cyber security fundamentals and lab setup
- Broken access control (OWASP #1)
- Cryptographic failures (OWASP #2)
- SQL injection and injection attacks
- Cross-site scripting (XSS)
- CSRF and security misconfiguration
- Vulnerable and outdated components
- Security logging and monitoring failures
- Server-side request forgery (SSRF)
- Network security fundamentals: scanning and DNS
- Firewalls and network defence
What students leave with
Students can identify and explain the mechanisms behind the most prevalent web application vulnerabilities, perform controlled attacks in a lab environment, implement defensive countermeasures in code, and reason about network-level threats. This module is the foundation for the third-year security modules and for any student pursuing a career in security operations, development, or testing.