Breach Defense

Learn the OWASP Top 10:2025 by stopping attacks. 10 lessons with vulnerable and fixed C#, a defense game with 38 attack scenarios, 31 quiz questions and a .NET cheat sheet.

OWASP Top 10:2025 explained for .NET developers

Breach Defense teaches the OWASP Top 10:2025 through vulnerable and fixed C# code, a game where you stop real attack patterns, and 31 quiz questions. It focuses on ASP.NET Core, EF Core and NuGet, but the ideas apply to any web stack.

The OWASP Top 10:2025

  1. A01 Broken Access Control (now including SSRF)
  2. A02 Security Misconfiguration
  3. A03 Software Supply Chain Failures (new)
  4. A04 Cryptographic Failures
  5. A05 Injection
  6. A06 Insecure Design
  7. A07 Authentication Failures
  8. A08 Software or Data Integrity Failures
  9. A09 Logging and Alerting Failures
  10. A10 Mishandling of Exceptional Conditions (new)

Frequently asked questions

What changed in the OWASP Top 10 2025?

Two categories are new: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. SSRF was merged into A01 Broken Access Control, and Security Misconfiguration moved up to A02.

What is the number one OWASP risk?

Broken Access Control remains A01. It covers users acting outside their permissions, such as reading other users' data by changing an ID, calling admin functions or making the server fetch internal URLs.

How do you prevent SQL injection in .NET?

Use parameterized queries. EF Core LINQ queries are parameterized automatically. For raw SQL use FromSql or FromSqlInterpolated, never FromSqlRaw with string interpolation or concatenation.

How should passwords be stored in ASP.NET Core?

Hash them with a slow, salted algorithm. ASP.NET Core Identity's PasswordHasher uses PBKDF2. Bcrypt and Argon2 are also good choices. Never use plain SHA-256 or reversible encryption.

What is a software supply chain attack?

An attack through the code and tools you depend on: typosquatted or malicious packages, dependency confusion, compromised maintainers or tampered CI pipelines. Use package source mapping, vulnerability scanning, SBOMs and pinned CI actions.

Progress, XP and badges are saved in your browser only.