OWASP Top 10 · 2025 edition

OWASP Top 10 Challenges in Go

Cover the OWASP Top 10:2025 with hands-on Go secure coding challenges. Your developers find and fix real vulnerabilities in real Go apps. You get evidence of capability, not just completion.

Book a Demo Explore the Mapping

Ready when the auditor asks

Generate Your OWASP Top 10 Training Report

Every completed challenge rolls up into a OWASP Top 10 training report. Point and click to generate it, then hand it straight to your auditor, customer or partner the moment they ask for evidence.

Capability, not checkbox compliance

Hands-On Challenges for Every Category

The OWASP Top 10 is the industry benchmark for web application security, the list your auditors, customers and security team measure against. Every challenge below is a real Go application with a real vulnerability: developers fix it without breaking functionality, and every verified fix becomes reportable evidence of secure coding capability.

A01:2025

Broken Access Control

Users acting outside their intended permissions is the most common web application risk. The 2025 edition folds Server-Side Request Forgery into this category.

SSRF.go

In this challenge we learn how to exploit and fix Server Side Request Forgery.

Bad Token.go

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

No Sutpo.go

This appsec challenge is inspired after Optus API incident. It has a number of security vulnerabilities in relation to API.

Steam.go

This appsec challenge is inspired by the Steam client privilege escalation vulnerability. It showcases Time of Check, Time of Use (ToCToU)…

Capital0.go

This challenge is inspired by the Capital One hack. It highlights a number of security checks that must be in place to protect against SSRF.

A02:2025

Security Misconfiguration

Insecure default configurations, verbose errors, exposed secrets and unhardened services are now the #2 web application risk.

Secret Leak.go

Secrets such as an API or encryption key are used for various security operations. Disclosure of the secret can severely undermine the security of…

No Sutpo.go

This appsec challenge is inspired after the Optus API incident. It has a number of security vulnerabilities in relation to API.

A03:2025

Software Supply Chain Failures

New in 2025: compromises across dependencies, build systems and distribution infrastructure, expanded from Vulnerable and Outdated Components.

Curl Eval

A build step pipes a remote script straight into a shell. Harden the pipeline so it no longer executes unverified code from the network.

Dependency Confusion

A CI/CD pipeline resolves an internal package name from a public registry. Fix the workflow so a look-alike public package can never shadow your…

Target Code

A poisoned pipeline execution lets untrusted code changes run with the workflow’s privileges. Lock down what the pipeline checks out and runs.

A04:2025

Cryptographic Failures

Weak or missing cryptography that exposes sensitive data: predictable randomness, poor key handling, and broken token generation.

Randomness.go

While there are libraries to generate random numbers, not all of them are suitable for security. This challenge will explore this weakness and ways…

Bad Token.go

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

A05:2025

Injection

Untrusted data interpreted as code or commands, such as SQL injection, command injection, log injection, XSS and friends.

Command Injection.go

When untrusted data is used as an argument to an external program, command injection can happen. In this appsec challenge, we explore how to exploit…

SQL Injection.go

This is a classic security challenge where an app uses a SQL database and does not use parametrised query or ORM.

Log Injection.go

Although the Log4Shell RCE vulnerability took many by surprise, log injection has been a known vulnerability, and there are numerous other edge cases…

Pollution.go

This challenge is inspired by the Android Master Key security flaw. We learn a popular security design flaw that is related to misinterpretation…

A06:2025

Insecure Design

Security flaws baked into the design itself: missing rate limits, weak password policies, and logic that can be abused even when implemented "correctly".

Energy.go

This challenge is inspired by the Energy Australia security incident. It showcases a number of security vulnerabilities on an authentication…

Bad Password.go

A password or a memorized secret must possess a variety of security features. In addition to preventing users from selecting weak passwords, the…

Bad Token.go

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

StackOverflow.go

This challenge is inspired by the StackOverflow outage security incident. It showcases insecure usage of regular expression engines to perform…

A07:2025

Authentication Failures

Broken login, session and token handling that lets attackers assume other users’ identities.

JWT.go

Official JWT libraries have done a good job in enforcing token security by default. However, there are still a number of weaknesses that can be…

Bad Password.go

A password or a memorized secret must possess a variety of security features. In addition to preventing users from selecting weak passwords, the…

Bad Token.go

A token can be used for a one time operation: password reset, email verification, setting up multi factor authentication, etc. Therefore, secure…

No Sutpo.go

This appsec challenge is inspired after the Optus API incident. It has a number of security vulnerabilities in relation to API.

A08:2025

Software or Data Integrity Failures

Code and data accepted without integrity verification: insecure deserialization, prototype pollution, and unsafe update mechanisms.

Command Injection.go

When untrusted data is used as an argument to an external program, command injection can happen. In this appsec challenge, we explore how to exploit…

A09:2025

Security Logging and Alerting Failures

Missing, forgeable or unmonitored logs that let breaches go undetected. Renamed in 2025 to emphasise alerting.

Log injection.go

Although the Log4Shell RCE vulnerability took many by surprise, log injection has been a known vulnerability, and there are numerous other edge cases…

A10:2025

Mishandling of Exceptional Conditions

New in 2025: improper error handling, fail-open logic and unexpected runtime states that attackers can force.

Panic DoS.go

An unhandled panic lets a single malicious request crash the whole service. Handle the exceptional condition so the app degrades gracefully instead…

Roll it out

Turn the Standard Into a Training Program

Assign these challenges to your team as learning pathways, track verified fixes, and report OWASP Top 10 coverage to auditors, customers and the board, with evidence, not attendance sheets.

Book a Demo Browse all challenges