OWASP Foundation Courses

Detecting and Defending Against State-Actor Surveillance

Explore state-sponsored surveillance techniques and learn effective detection and defense strategies against high-tech spying methods used by well-funded agencies.

• YouTube
• 18 minutes
• Self-Paced
• Conference Talk

Mobile Security Session

Explore mobile security risks, developmental controls, and industry best practices to build and maintain secure mobile applications with expert Jason Haddix.

• YouTube
• 17 minutes
• Self-Paced
• Conference Talk

CSRF Defense Strategies - Not All Are Created Equal

Explore CSRF vulnerabilities, defense mechanisms, and their implementations. Learn about synchronizer token patterns, double submit cookies, and challenge-response systems for effective protection against CSRF attacks.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Can AppSec Training Really Make Developers Security-Smart?

Explore the effectiveness of AppSec training for developers through a year-long survey, revealing surprising insights on knowledge retention and practical application in software security programs.

• YouTube
• 33 minutes
• Self-Paced
• Free Video

DIY Command and Control for Fun and No Profit

Hands-on exploration of Command & Control botnets, providing insight into cybercriminal operations. Includes live malware demonstration for a realistic glimpse into this dark corner of the internet.

• YouTube
• 1 hour 2 minutes
• Self-Paced
• Free Video

The Cavalry Is Us - Cybersecurity Activism in the Internet of Things Era

Exploring cybersecurity challenges in IoT and the need for collective action. Calls for researchers and professionals to shape the future of digital security and address emerging threats.

• YouTube
• 47 minutes
• Self-Paced
• Free Video

Surviving an Application DoS - Strategies and Open Source Defense Framework

Explore strategies to defend against Application-Level DoS attacks using a new open-source Node.js framework. Learn to identify threats, analyze traffic patterns, and implement active defense measures.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

Libinjection: From SQLi to XSS Detection - New Algorithm Introduction

Explore advanced techniques for detecting SQLi and XSS attacks using libinjection, a fast and accurate algorithm. Learn about its implementation, benefits, and future developments in web security.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Million Browser Botnet - Creating a JavaScript-Driven Browser Botnet for DDoS Attacks

Explore how online advertising networks can be exploited to create massive browser botnets for various malicious activities, including DDoS attacks and password cracking, without leaving traces.

• YouTube
• 48 minutes
• Self-Paced
• Free Video

Next Generation Red Teaming - Integrating Application-Centric Attacks

Explore advanced red teaming techniques integrating application-specific attack surfaces for more realistic and effective security assessments across multiple domains.

• YouTube
• 46 minutes
• Self-Paced
• Free Video

Guidance on Avoiding Programming Language Vulnerabilities - TR24772 Explanation

Overview of ISO/IEC TR 24772:2010, guiding programmers on avoiding vulnerabilities through language selection and use. Insights from a contributor on enhancing software security.

• YouTube
• 15 minutes
• Self-Paced
• Free Video

The Perilous Future of Browser Security

Explore browser security challenges, tradeoffs, and solutions. Learn about critical vulnerabilities, secure browser design, and balancing security with user experience in the face of evolving threats.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

Can AppSec Training Really Make a Smarter Developer?

Explores the effectiveness of AppSec training for developers through a year-long survey, revealing surprising insights on knowledge retention and its impact on application security strategies.

• YouTube
• 45 minutes
• Self-Paced
• Free Video

Women in Information Security Panel - Challenges and Opportunities

Panel discussion exploring challenges and opportunities for women in information security, featuring insights from industry leaders on diversity, career advancement, and strategies to increase female representation in the field.

• YouTube
• 49 minutes
• Self-Paced
• Free Video

OWASP Broken Web Applications - Future Developments Beyond Version 1.0

Explore OWASP's virtual machine with 25+ vulnerable web applications for security training and testing. Learn about project features and future developments in web application security.

• YouTube
• 49 minutes
• Self-Paced
• Free Video