Practice status

{{ summaryValue }}

{{ summaryLine }}

Build a practice round

Unofficial OWASP Top 10:2025 practice for developers and reviewers. Forty original scenarios cover category recognition and defensive decisions. This curated bank is not a certification, penetration test or assurance that an application is secure.

Each category has two questions per practice type. Foundation introduces the control; applied questions distinguish boundaries or verify it. Short rounds sample uniformly and may omit categories.

OWASP Top 10:2025 · Guidance by the OWASP Top 10 Team, CC BY 3.0. Questions independently authored by simplified.tools; no OWASP endorsement. Verified 11 September 2026.

Optional: leave blank for the default seed. A seed reproduces the same questions and option order; it is not a security credential.

{{ seedNotice }}

{{ quizSetupValidation }}

{{ answeredCount }} of {{ questionCount }} answered · {{ progressPercent }}%

{{ progressStatusLine }}

Question {{ quizCursor + 1 }} of {{ questionCount }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

Answer recorded. Explanations appear at the end of the round.

{{ currentResultRow.feedback }}

{{ currentResultRow.explanation }}

Source: {{ currentResultRow.source.reference }} · {{ currentResultRow.source.version }} · {{ currentResultRow.source.license }}

Review what to practice next

{{ resultLead }}

This score describes only these authored questions. Apply the referenced guidance in design reviews and testing; a quiz cannot establish application security.

{{ learningReviewTitle }}

{{ learningReviewLine }}

{{ card.label }}
{{ card.value }}
{{ card.note }}

Missed answer review

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    Source: {{ item.source.label }} · {{ item.source.version }} · {{ item.source.license }}

Category performance

Which categories need another look? Correct and missed answers in this round; A01–A10 refer to the 2025 categories. Unsampled categories are not evidence of competence.

Loading topic-performance chart…

{{ quizChartStatus }}

{{ quizChartExportStatus }}

Answer ledger

Question ID Prompt Topic Your answer Correct answer Outcome Explanation Source Copy
{{ row.question_id }} {{ row.prompt }} {{ row.category_label }} {{ row.selected_answer_label }} {{ row.correct_answer_label }} {{ row.outcome_label }} {{ row.explanation }} {{ row.source ? `${row.source.label} · ${row.source.version} · ${row.source.license}` : '—' }}

{{ quizLedgerStatus }}

CSP Header Policy Checker Check a Content-Security-Policy header for risky script sources and missing baseline directives, with reporting and rollout blockers explained.
CORS Policy Risk Checker Review CORS response headers for unsafe origin trust and credential use, then catch cache or private-network combinations that need priority fixes.
Dockerfile Security Basics Checker Check a Dockerfile for risky base images, embedded secrets, broad copies, root users, package residue, and missing runtime safeguards.
HTTP Security Headers Checker Audit pasted HTTP security headers for browser policy, session protection and exposure risks with local scoring and a prioritized fix order.

A refund feature can work exactly as specified and still allow more money to be returned than was paid. The defect is the missing business rule, not necessarily a broken line of code. Web-application security review therefore has to examine what an application permits, what it trusts, and what happens when requests or dependencies behave unexpectedly.

The Open Worldwide Application Security Project (OWASP) Top 10 groups important web-application security risks into broad categories. It is an awareness document for developers and security practitioners, rather than a complete application-testing checklist. Its categories provide a shared vocabulary for discussing weaknesses during design reviews, code reviews, deployment checks and incident investigations.

Authentication
Establishing who is making a request and maintaining that identity through a session. Login protections and session management belong here.
Authorization
Deciding whether that identity may access a particular record or perform an action. Being signed in does not automatically grant permission.
Integrity and authenticity
Checking that software or data has not been altered without authorization and comes from the expected source. A familiar filename or readable data format proves neither.

Confusing these properties leads to fixes that protect the wrong thing. Encrypting a connection does not decide which customer may read an invoice. Hiding an export button does not enforce permission on the server. Similarly, accepting text from a signed-in user does not make that text safe to interpret as database instructions or browser markup.

The point where information moves from a less-trusted source into a trusted decision is a trust boundary. Boundaries exist between a browser and a server, between customers sharing a service, and between downloaded software and the system that installs it. A weakness may affect several boundaries, so the same harmful outcome can have different causes. An unauthorized action might result from an absent permission check, a compromised login, or an error path that grants access after a timeout.

Useful security review connects a cause to both a mitigation and a verification step. A mitigation changes the behaviour that permits the weakness. Verification checks whether that protection actually holds, including requests that should be rejected and failures that interrupt normal operation. A successful ordinary transaction does not test rollback after an interruption, and the existence of a log does not prove that a suspicious event reaches someone responsible for responding.

Category numbers must be read with their edition. The 2025 list includes the broader software supply-chain category and a category for mishandling exceptional conditions. Remembering a number from the 2021 list without its name can produce the wrong classification.

Knowledge practice can reveal a misunderstood distinction, but it cannot establish application security or professional competence. Actual assurance requires application-specific requirements, review and testing within an authorized scope. The separate OWASP Application Security Verification Standard (ASVS) provides technical security requirements for that work; knowing the Top 10 is not an ASVS assessment.

How to Use This Tool:

The initial setup is a 10-question round using Recognise the category, Mixed difficulty, All categories and feedback After each answer.

  1. Choose the skill under Practice. Recognise the category asks for the category that best matches a scenario. Mitigation and verification asks for a defensive change or a test. Under Scenario difficulty, choose Foundation for introductory controls, Applied distinctions for boundaries and verification, or Mixed for both.
  2. Select a Category and Question count. Narrowing the category or difficulty reduces the available questions. When the current count no longer fits, it resets to the selected pool's default.
  3. Set Feedback to match how you intend to study. After each answer reveals correctness and an explanation immediately. End of the round records each choice but withholds correctness and explanations until the completed review.
  4. Enter an optional Replay seed under Advanced. Leading and trailing spaces are ignored, and the limit is 128 characters. Leaving it blank uses a fixed default seed, not a fresh random draw. An overlong value produces a notice and falls back to the default.
  5. Select Start practice, then choose one of the four text answers for each scenario. Selecting an answer records and locks it for that attempt. Continue with Next question, then View results after the last answer. There is no skipped-question or early-finish result.
    If Start practice is disabled, reselect an available category, feedback option and question count. Change setup clears the current attempt rather than pausing it.
  6. Review Missed answer review and the Answer ledger. Compare the selected answer with the correction and its explanation before choosing another round.

Interpreting Results:

During a round, Practice status and the progress percentage show how many questions have been answered, not how many were correct. After completion, the headline changes to correct answers out of the selected total. There is no pass/fail threshold, certification result or weighted proficiency grade. The quiz performs no application scan or penetration test. Perfect round means only that every question in that particular round was answered correctly.

Category performance shows counts of Correct and Missed answers. Short rounds can give different categories different numbers of questions, so raw misses are not comparable proficiency ratings. A suggested review focus identifies the category with the most misses in the attempt. An unsampled category has not been assessed.

The Answer ledger retains the prompts, categories, selected answers, correct answers, outcomes, explanations and source information. Review an explanation even after a correct guess.

Retry missed starts a separate attempt containing only incorrect answers and is absent after a perfect round. A higher retry score does not revise the original score or demonstrate broader coverage. Replay same seed rehearses the same challenge, while Try a new seed can change the selection or order but may repeat questions. Compare attempts with their practice type, difficulty and sampled questions in mind.

Technical Details:

Risk categories describe recurring causes of security failure, not ten mutually exclusive outcomes. Classification depends on the control or trust boundary named in the scenario. Defensive questions then require a change or test that addresses that particular cause, rather than an unrelated security improvement.

The 2025 categories and their defenses

The category names below follow OWASP Top 10:2025. The examples connect the authored scenarios to their defensive principles without claiming to enumerate every weakness in each category.

Category Weakness illustrated Defensive principle
A01:2025 Broken Access Control A known user reads another customer's record or performs an action outside their role. Enforce record ownership and action permissions on the server. Verify both allowed and denied requests.
A02:2025 Security Misconfiguration Development diagnostics remain public, or an Extensible Markup Language (XML) parser resolves external resources unnecessarily. Apply a hardened deployment configuration. Disable unnecessary external-entity resolution and verify the resulting behaviour.
A03:2025 Software Supply Chain Failures Indirect dependencies are unknown or unsupported, or one identity controls both build changes and release publication. Maintain release-specific dependency inventories and update processes. Restrict privileges and separate change and release authority.
A04:2025 Cryptographic Failures Passwords use fast unsalted hashes, or encrypted connections skip certificate verification. Use adaptive, salted password hashing with an appropriate work factor. Validate the certificate trust chain and intended hostname.
A05:2025 Injection Untrusted input becomes database instructions or active browser markup. Bind database values as data. Render plain text as text, and use appropriate sanitization when rich content is deliberately supported.
A06:2025 Insecure Design Refund constraints are missing, or the architecture has no plan to isolate tenants, meaning separate customers or organizations. Define misuse cases and enforceable business rules. Plan tenant separation through storage, caches and background work.
A07:2025 Authentication Failures Automated reuse of leaked credentials is uncontrolled, or a pre-login session identifier remains valid after login. Combine suitable multifactor authentication, breached-password checks and bounded login protections. Replace the session identifier after login and retire the old one.
A08:2025 Software or Data Integrity Failures Client-modifiable saved state or a downloaded software update is treated as trustworthy without suitable verification. Validate permitted data and verify authenticity and integrity where required. Software verification must be anchored in a trusted source.
A09:2025 Security Logging and Alerting Failures Events lack investigative context or never trigger a response from an accountable recipient. Retain useful event, time, actor and request context without recording credentials or tokens. Test detection, alert delivery and response.
A10:2025 Mishandling of Exceptional Conditions A permission check grants access after a timeout, or an interrupted transaction leaves partial changes and reports success. Deny a protected action when permission is unknown. Test failure handling that preserves a consistent outcome and reports failures accurately.

XML external-entity weaknesses are mapped to A02 in the 2025 edition, while cross-site scripting belongs to A05. These mappings should not be inferred from older category numbers. The Common Weakness Enumeration (CWE) catalog identifies individual weakness types; four authored scenarios per category do not provide exhaustive CWE coverage.

Distinguishing overlapping failures

A03 concerns the broader process of obtaining, building, distributing and maintaining software. A08 focuses more directly on accepting particular software or data as trusted without verifying it. An unchecked update can relate to both, but a question about the missing update-verification step points to A08.

The emphasis also matters for credentials. Weak protection of stored password verifiers points to A04, while automated abuse of the login flow or session fixation points to A07. A salted password hash uses a per-password salt and a deliberately costly hashing process to resist offline guessing; it does not control repeated login attempts by itself. Conversely, login throttling does not repair weak stored hashes. Throttling must also avoid making account lockout an easy way to deny service to legitimate users.

A missing permission check during normal operation points to A01. Granting permission because an authorization dependency failed points to the exceptional path addressed by A10, even though the resulting harm also involves access control. A06 applies when a necessary control was absent from the design, such as an architectural plan for tenant separation. It is not a catch-all label for every programming defect.

Question coverage and selection

The bank contains 40 original text questions independently authored by simplified.tools, not official OWASP questions. No OWASP affiliation or endorsement is claimed. Each category has one foundation and one applied question for recognition, plus one foundation and one applied question for mitigation or verification. The bank cites the final 2025 guidance and records a source-check date of 11 September 2026; that date is not a guarantee of exhaustive coverage or continuing currency.

A round uses one practice type, so recognition and mitigation each have a maximum pool of 20 questions. Mixed combines the two difficulty levels, not the two practice types. There is no combined 40-question setup.

Category scope Scenario difficulty Questions in the pool Permitted round counts
All categories Mixed 20 1, 2, 5, 10, 20
All categories Foundation or Applied distinctions 10 1, 2, 5, 10
One category Mixed 2 1, 2
One category Foundation or Applied distinctions 1 1

Questions are selected without replacement within a round, using uniform selection rather than a quota for each category. A 10-question mixed round can therefore omit categories. Selecting all 20 mixed questions covers two questions per category for the chosen practice type. Selecting all 10 foundation or applied questions covers one per category. Missed-question retries use their own smaller total rather than being restricted to the normal setup counts.

Each question presents its authored correct answer and three authored alternatives in seeded order. Reproducibility requires the same seed, practice type, category, difficulty, question count, feedback setting and unchanged question bank. A new seed does not create new content. When every question in a pool is selected, changing the seed cannot change which questions belong to that round.

Score and progress

Every question has equal weight. A correct answer earns one point, an incorrect answer earns zero, and there is no partial credit or deduction for a wrong choice. With N selected questions, the possible score is N points and the score ranges from zero to N.

Let C be the number of correct answers, A the number of recorded answers, and N the total selected for the current round. The counts are integers with 0 ≤ C ≤ A ≤ N and N ≥ 1. Points equal C. Unanswered questions remain in N but are not incorrect or included in a missed-answer retry. The final Practice status score is C out of N. Its percentage equivalent uses the full selected total, including questions not yet answered during a partial attempt.

Accuracy (%) = 100 × C N

Progress measures completion rather than correctness, so it uses the number of recorded answers instead.

Progress (%) = 100 × A N

Accuracy retains its unrounded ratio. The visible progress label rounds to the nearest whole percent, with half-percent ties upward. The final correct-out-of-total fraction preserves the exact counts. Completion requires an answer to every selected question.

For a 10-question attempt with four recorded answers, three correct, progress is 40% and accuracy is 30%. There is one incorrect answer and six unanswered questions, not seven incorrect answers. The attempt is still incomplete. Changing feedback timing does not change the points awarded for a given answer.

Privacy and Saved Attempts:

Scoring takes place in the browser, but saved attempts are carried in the page address. The address includes the round setup, seed, recorded choices and current position, including partially completed attempts. Someone receiving that address can restore the recorded choices while the saved attempt remains compatible. This is not encrypted or private progress storage. Treat a shared address as a shared attempt, not a blank quiz, and do not put credentials or personal details in Replay seed.

Change setup removes the current attempt from the active page address. It does not erase browser history or copies already shared. There is no account-based progress record. If Saved attempt unavailable appears because an address is incompatible or invalid, choose the available setup options and start a new round.

Browser scoring is not a promise of offline operation or zero transmission. Page and chart resources can load over the network, and an address can be transmitted when opened or shared. The quiz does not establish a site-wide logging or retention guarantee.

Worked Examples:

An access failure caused by a timeout

A two-question Recognise the category round using Mixed difficulty and A10:2025 Mishandling of Exceptional Conditions contains the authorization-timeout and interrupted-transfer scenarios. Selecting A01 for the timeout but A10 for the interrupted transfer produces a score of 1/2, equivalent to 50%. The correction identifies the timeout's unsafe error handling as A10, even though it leads to unauthorized access. Retry missed then contains only the timeout question. Answering that retry correctly gives 1/1 for the new attempt, not 2/2 for the original one.

Protecting the wrong interpreter

Choose Mitigation and verification, Foundation and A05:2025 Injection for the one-question database-search scenario. Selecting the option to HTML-encode the value before joining it into Structured Query Language (SQL) text produces 0/1. Hypertext Markup Language (HTML) encoding addresses browser markup, not the database's query structure. The correct answer is a parameterized query with the search value bound as data. In a real code review, the follow-up is to confirm that the value is bound separately rather than inserted into executable query text.

References: