1. Home
  2. Knowledge Center
  3. Cyber A to Z
  4. Chapter 11
Protecting your systemsChapter 11

Web application security

The OWASP Top 10 2025 told through real cases, security headers, what a WAF can and cannot do, DAST and penetration testing, and the OWASP ASVS.

Nestor
Presented byNestor
10 min readUpdated on 2 October 2026

What you will learn

  • Understand the ten risk categories of the OWASP Top 10, 2025 edition
  • Follow an attacker’s reasoning against a web application, using real cases
  • Put the essential HTTP security headers in place
  • Know what a WAF protects, and what it does not
  • Choose between DAST, penetration testing and bug bounty, and require the OWASP ASVS

Free chapter with your account

Chapter 1 is free to read. Chapters 2 to 21, like the Junior, Senior and Expert levels of the Cyber Quiz, are free too: all you need is a free KrakenShield account with a confirmed email address.

Checking your access…

From theory to practice

So how does your system measure up?

Create your account and get an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Run the audit from your account: an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Create your account Audit my domains See capabilities
Belinda

Contact us

A question, a project, a partnership? Write to us: the team answers by email, usually within one business day.

Your details are only used to answer you. Do not include passwords or vulnerability details.