NOA Labs
🛡️ Application Security · Corporate training

OWASP Top 10 & Secure Coding

Find and fix the OWASP Top 10 in real code — injection, broken access control, insecure design and more — with secure patterns for Java, .NET, PHP, Python and Node.js.

Register your company → See the full outline ↓
$69 per employee · complete course
🗓️
3 weekends
Sat & Sun
⏱️
24 hours
6 live sessions
🎯
Advanced
Level
🧪
6 labs
Hands-on

Default hours 10:00 AM–2:00 PM (Asia/Karachi). Company pays — employees never pay individually.

About this training

A developer-first programme where every vulnerability is exploited in a lab and then fixed in code. Teams learn secure design, threat modelling, secure code review and how to embed SAST and dependency scanning into daily work. Examples come from banking and fintech applications: transfers, statements, KYC uploads and admin panels.

Who it's for: Backend, frontend and mobile developers, tech leads and QA engineers.

What your team will be able to do

  • ✔Exploit and remediate every OWASP Top 10 category in a vulnerable banking app
  • ✔Apply secure coding patterns for authentication, authorisation and input handling
  • ✔Threat-model features before they are built
  • ✔Perform structured secure code reviews
  • ✔Use SAST, SCA and secret scanning to prevent regressions

Advanced course outline

🔒 Session notes & lab guides unlock for enrolled employees
Weekend 1
Weekend 1 · Saturday

Secure design & threat modelling

Security starts before the first line of code.

  • ▸Insecure design as a vulnerability class
  • ▸STRIDE threat modelling for features
  • ▸Abuse cases and security requirements
  • ▸Trust boundaries and data-flow diagrams
  • ▸Secure defaults and least privilege
🧪 Lab: Threat-model a funds-transfer feature 🔒 Session notes 🔒 Lab guide
Weekend 1 · Sunday

Broken access control

The #1 web risk: IDOR, privilege escalation and forced browsing.

  • ▸Insecure direct object references (IDOR)
  • ▸Vertical and horizontal privilege escalation
  • ▸Deny-by-default authorisation
  • ▸Policy enforcement in middleware vs services
  • ▸Testing authorisation systematically
🧪 Lab: Exploit and fix IDOR in a statements API 🔒 Session notes 🔒 Lab guide
Weekend 2
Weekend 2 · Saturday

Injection & input handling

SQL, NoSQL, command and template injection — and why parameterisation wins.

  • ▸SQL injection and parameterised queries
  • ▸NoSQL and ORM injection pitfalls
  • ▸OS command and template injection
  • ▸Cross-site scripting and output encoding
  • ▸Validation vs sanitisation vs encoding
🧪 Lab: Injection exploit-and-fix sprint 🔒 Session notes 🔒 Lab guide
Weekend 2 · Sunday

Authentication, sessions & cryptography

Identification failures and cryptographic mistakes.

  • ▸Password storage with Argon2id/bcrypt
  • ▸MFA and session fixation
  • ▸JWT pitfalls and secure token handling
  • ▸TLS, key management and secrets
  • ▸Common crypto mistakes: ECB, static IVs, home-grown crypto
🧪 Lab: Harden a login and session flow 🔒 Session notes 🔒 Lab guide
Weekend 3
Weekend 3 · Saturday

Components, integrity, SSRF & misconfiguration

Supply chain, deserialisation, SSRF and insecure defaults.

  • ▸Vulnerable and outdated components
  • ▸Software and data integrity failures
  • ▸Server-side request forgery (SSRF)
  • ▸Security misconfiguration and headers
  • ▸Logging and monitoring failures
🧪 Lab: SSRF to cloud metadata 🔒 Session notes 🔒 Lab guide
Weekend 3 · Sunday

Secure code review & automation

Making secure coding a habit, not an event.

  • ▸Structured secure code review checklists
  • ▸SAST with Semgrep: rules and triage
  • ▸Dependency scanning and SBOMs
  • ▸Secret scanning in pre-commit and CI
  • ▸Security champions programme
🧪 Lab: Add security gates to a repository 🔒 Session notes 🔒 Lab guide
📝
Final assessment & certificate
Multiple-choice assessment plus attendance requirement → verifiable QR certificate.

Related application security courses

🔌 API & Microservices Security
3 weekends · $79

Enrol your team in OWASP Top 10 & Secure Coding

One invoice for the whole team, volume discounts applied automatically.

Register your company → All corporate courses