OWASP Foundation Courses

HTTP3 Security

Examines HTTP/3 security through QUIC handshakes, passive proxies, deep packet inspection, packet decryption, and qlog analysis.

• YouTube
• 1 hour 19 minutes
• Self-Paced
• Conference Talk

Insecure Deserialization, and How Not to Do It

Explore insecure deserialization through session-cookie demos, examining its vulnerabilities and practical solutions.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

OWASP Based Threat Modelling - Creating A Feedback Model in an Agile Environment

Learn how to integrate threat modeling into agile development through a feedback model, from requirement gathering and onboarding to risk balancing and threat landscape baselining.

• YouTube
• 44 minutes
• Self-Paced
• Conference Talk

How to Find and Prevent Entire Classes of Security Vulnerabilities

Learn variant analysis techniques for finding and preventing entire classes of software vulnerabilities through code navigation, automation, and real-world examples.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

The Security We Need - Designing Usable IoT Security

Design usable IoT security with clear defaults, targeted risk information, anomaly detection, and revocable authorization.

• YouTube
• 42 minutes
• Self-Paced
• Conference Talk

Choosing the Right Static Code Analyzers Based on Hard Data

Evaluate static code analyzers using hard data on coverage, integration, speed, scalability, reporting, and results quality.

• YouTube
• 40 minutes
• Self-Paced
• Conference Talk

The State of Credential Stuffing and the Future of Account Takeovers

Examines how credential stuffing scales into account takeovers and how bot detection, browser fingerprinting, rate limits, and multifactor authentication defenses can be bypassed.

• YouTube
• 41 minutes
• Self-Paced
• Conference Talk

Injecting Security Controls in Software Applications

Learn to integrate security controls into the software development life cycle using real-world examples of injection, vulnerable components, libraries, and logging.

• YouTube
• 32 minutes
• Self-Paced
• Conference Talk

Testing and Hacking APIs

Uncover API vulnerabilities by analyzing API traffic, evaluating access controls, and exploiting mass-assignment flaws during modern application penetration tests.

• YouTube
• 28 minutes
• Self-Paced
• Conference Talk

Bringing Rapid Prototyping to the Threat Model Process

Learn Rapid Threat Model Prototyping, a just-in-time process for identifying high-threat areas and integrating threat analysis into Agile and DevOps workflows.

• YouTube
• 34 minutes
• Self-Paced
• Conference Talk

Uninvited Guests - Understanding Malicious Web Bots with OWASP Handbook

Understand malicious web automation through OWASP guidance, real-world examples, and countermeasures for scraping, scalping, account takeover, and ad fraud.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

What Do You Mean Threat Model Every Story

Learn how to adapt threat modeling for continuous development by building a practical baseline and teaching principles that keep pace with rapidly evolving systems.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Common API Security Pitfalls

Assess common API security pitfalls involving authentication, tokens, cryptography, cross-origin requests, and input validation.

• YouTube
• 31 minutes
• Self-Paced
• Conference Talk

Preventing Mobile App and API Abuse

Explore defense-in-depth techniques for stopping reverse engineering, stolen secrets, and abnormal API use in mobile apps and their backends.

• YouTube
• 53 minutes
• Self-Paced
• Conference Talk

Threat Model Every Story - Practical Continuous Threat Modeling Work for Your Team

Explore continuous, team-based threat modeling for rapidly changing Agile software, including practical approaches and threat-modeling-as-code with PyTM.

• YouTube
• 49 minutes
• Self-Paced
• Conference Talk