ransomleak/training-application-securityInteractive secure coding training with hands-on SCORM exercises covering OWASP Top 10 web and API vulnerabilities, Git/secrets exposure, and remediation examples in 10+ languages.
40 free, open-source secure coding exercises that teach web application security the way developers learn — by exploiting real vulnerabilities like SQL injection, cross-site scripting (XSS), and broken access control, then writing the fix. Interactive SCORM modules covering the OWASP Top 10 for Web, API, Git repository security and much more. Remediation examples in JavaScript, TypeScript, Java, C#, Python, Scala, PHP, Ruby, Go, and Kotlin.
👥 Talk to the Founders | 🔗 Browse the Full Library | 🎮 Try a live DOM XSS demo
Reading the OWASP Top 10 once a year and passing a multiple-choice quiz does not prevent web application vulnerabilities in production. Developers need to see what a real exploit does — SQL injection dumping a database, cross-site scripting hijacking a session, broken access control exposing another user's data — and then write the secure code that stops it.
Every exercise in this library follows a three-phase methodology: exploit, trace, remediate.
You run a hands-on penetration test against an intentionally vulnerable application — SQL injection against a database, XSS that fires in a browser, SSRF that reaches the cloud metadata endpoint — then trace exactly how the vulnerability was introduced and apply secure coding best practices to fix it.
Exercises cover:
Every exercise ends with a quiz at a 100% pass threshold. By the time a developer is writing production code, they have already exploited every common web application vulnerability and know the secure coding best practices that prevent it.
Every exercise ships as a SCORM 1.2 .zip — import into any LMS (Moodle, SAP SuccessFactors, Cornerstone, TalentLMS, or anything SCORM-compliant), embed into your SDLC training pipeline, or preview on SCORM Cloud before rollout.
White-labeled — no logos, no backlinks, no vendor lock-in. Use them as part of a DevSecOps program, a secure SDLC initiative, or standalone application security training.
Licensed under Creative Commons Attribution-NonCommercial 4.0 International. You may use, adapt, and redistribute with attribution for any non-commercial purpose — internal training, workshops, university courses. Reselling the content as a standalone product is not permitted.
Need secure coding training at scale without running your own LMS? We ship an enterprise cloud platform purpose-built for application security training across engineering teams. Get in touch to see it in action.
Multi-tenant from the ground up — deliver application security training across your entire client portfolio from a single pane:
Interested? Reach out to us
Clickjacking — Steal a click on a bank approval button by overlaying a transparent iframe, capturing a real approval, and shipping CSP frame-ancestors.
Command Injection — Chain a second command onto a server-side tool by tampering a captured request, watching server secrets leak, and shipping argument-list execution.
Components with Known Vulnerabilities — Get code execution through an outdated library by exploiting a published CVE, running commands via a crafted upload, and bumping the version and scanning in CI.
Cross-Site Request Forgery — Move money from a page the victim never trusted by auto-posting a cross-site transfer, seeing why cookies ride along, and adding per-session tokens and SameSite.
Directory Traversal — Read system files through a download link by escaping the intended folder, pulling /etc/passwd from the server, and canonicalising then verifying.
DOM XSS — Trigger XSS the server never sees by hiding a payload in the URL hash, tracing an unsafe innerHTML sink, and swapping to textContent.
Forced Browsing — Pull an employee PII export from an unlinked route by reaching an internal URL anonymously, seeing why obscurity is not access control, and enforcing auth server-side.
Horizontal Privilege Escalation — Change one digit and read another customer by walking an IDOR from both sides, enumerating sequential record ids, and adding the missing ownership check.
Host Header Injection — Redirect a password-reset email to a lookalike domain by forging the X-Forwarded-Host header, stealing the clicked reset token, and pinning a configured base URL.
Broken Function Level Authorization — Call staff-only endpoints from a read-only account by reaching admin routes as an analyst, pulling a roster and queuing a payout, and adding a router-level role guard.
Broken Object Level Authorization — Swap an id and read another rider by changing the object id in a request, harvesting records by walking ids, and enforcing per-object ownership.
Broken User Authentication — Brute-force a six-digit login code by attacking an unlimited verify endpoint, taking over with only an email, and rate-limiting per account with 429.
Excessive Data Exposure — Read the fields the UI never shows by comparing rendered page to raw JSON, finding phone, birth date, and coordinates, and serializing a field allow-list.
Improper Inventory Management — Read records through a retired API version by swapping v2 for a deprecated v1, bypassing controls the new version enforces, and retiring old versions with 410 Gone.
Injection — Turn a search box into a full database read by breaking out of a catalog query, UNION-dumping the users table, and parameterizing so input stays data.
Insufficient Logging & Monitoring — Look up a customer and leave no trace by accessing a record with no ticket, seeing why no one can attribute it, and adding audit records and alerts.
Mass Assignment — Mint a loyalty balance with two extra keys by adding fields to a PATCH body, writing attributes you should not own, and binding only editable fields.
Security Misconfiguration — Read a signed-in account from any website by reflecting an arbitrary CORS origin, weaponizing a lure page, and locking CORS to an allow-list.
Secrets in Git History — Recover a live API key from the commit that removed it by walking the history of a cleaned-up config file, replaying a key that was never rotated, and rotating first then scrubbing with git filter-repo.
Exposed .git Directory — Rebuild an entire codebase from one public URL by finding a browsable .git in the web root, dumping the repository and recovering the source, and deploying build artifacts instead of the repo.
Committed Secret Files — Clone a public repo and read its committed .env by spotting secret files tracked since the first commit, untracking them with git rm --cached and rotating, and adding a .gitignore plus a pre-commit hook.
Commit Author Spoofing — Land a backdoor wearing a maintainer's name by harvesting an author identity from git log, reading the Unverified signature badge, and requiring signed commits for all contributors including administrators.
Branch Protection Bypass — Force-push over main and skip review and CI by rewriting history on an unprotected branch, shipping unreviewed code straight to production, and requiring pull requests, reviewers, and checks.
Leaked Access Tokens — Clone private repos with a token from a public gist by checking what an over-scoped token can reach, revoking and rotating instead of just deleting the gist, and reissuing fine-grained and short-lived tokens.
Malicious Pull Requests — Catch a backdoor hidden inside a friendly test fix by reading the full diff instead of the description, flagging out-of-scope edits to deploy scripts, and hardening review with CODEOWNERS and fork limits.
CI/CD Secret Exposure — Lift a deploy key straight out of a public build log by finding the workflow step that echoes a secret, stopping untrusted input from running as shell commands, and pinning actions by commit SHA and rotating the key.
Insecure URL Redirect — Hide a phishing page behind a real login by abusing the next parameter, seeing why the domain looks right, and allowing relative targets only.
Leftover Debug Code — Pull production secrets from a forgotten debug route by finding an env-dumping endpoint, reading JWT and database secrets, and failing closed with an allow-list.
PII in URL — Lift personal data straight out of a link by spotting identifiers in query strings, following the leak into logs and referrers, and rewriting to opaque tokens.
Reflected XSS — Craft a malicious URL that runs the moment it opens by reflecting a payload off a search page, understanding the victim-clicks-link flow, and escaping at the render boundary.
Server-Side Request Forgery — Make the server fetch its own cloud credentials by abusing a link-preview feature, reaching the metadata endpoint, and validating outbound destinations.
Session Fixation — Plant a session id and inherit the victim login by fixing a known id on the victim, watching login reuse it, and regenerating on every login.
SQL Injection — Dump a database through one unguarded lookup form by exploiting a tautology payload, exfiltrating tables with UNION SELECT, and shipping the parameterized fix.
Stored XSS — Plant a script in a comment and watch it fire by storing a payload in user content, seeing it execute for the next visitor, and escaping output at render time.
Token Exposure in URL — Replay a session token harvested from a referrer log by catching a token in a redirect URL, replaying it into a live account, and moving it to an HttpOnly cookie.
User Enumeration — Harvest a verified customer list from a login form by reading differing error bodies, measuring response-time leaks, and unifying errors and timing.
Vertical Privilege Escalation — Forge a role claim and become an administrator by tampering the session token, jumping from viewer to admin, and verifying tokens before trusting them.
Weak Randomness — Predict a password-reset token and take the account by sampling tokens from the generator, recovering Math.random() state, and moving to crypto.randomBytes.
XXE Injection — Read the password file through an XML upload by submitting a crafted purchase order, resolving an external entity, and disabling entity resolution.
Unrestricted Resource Consumption — Scrape a catalog with one oversized request by setting page size from the request, pulling 250,000 records at once, and capping page size server-side.
