MugUp logoMugUp
HomeBrowseAboutBlog
LoginSign Up
MugUp

Plan your day, study, read, write and track your habits in one app.

Follow MugUp

Product

  • Features
  • Compare
  • Free Tools
  • Deck Library
  • MugUp for Discord

Community

  • Blog
  • Changelog
  • Feature Requests
  • Deck Requests

Company

  • Home
  • About
  • Contact

© 2026 MugUp. All rights reserved.

Terms of ServicePrivacy PolicyCookie Policy
  1. Browse decks
  2. Application Security: OWASP and Secure Coding
Public deck

Application Security: OWASP and Secure Coding

The common vulnerability classes in web applications and APIs, such as injection, XSS, CSRF, broken access control and SSRF, how each one works, and how to prevent it in code and in your build pipeline.

Engineering
AShared by Alex Chen
0PlaySign in to clone

You’re reading a free preview. Sign up to see every topic and question — and to play this deck as games.

See the whole deck

Suggested order

Arrows point from what to learn first. Topics side by side can be studied in any order — and cloning the deck brings this order with it.

Topics

Open a topic to read through its content, then play just that topic.

Injection: SQL, Command and Template Injection
How untrusted input ends up being run as part of a SQL query, a shell command or a template, and the coding habits that stop it.
MCQ: 10
Fill-in: 7
Flashcards: 11
Pair match: 9
37 total questions
Cross-Site Scripting and Content Security Policy
How cross-site scripting gets script into a page, how output encoding and framework escaping stop it, and how a Content Security Policy limits the damage.
MCQ: 9
Fill-in: 7
Flashcards: 11
Pair match: 9
36 total questions
CSRF, CORS and the Same-Origin Policy
What the browser's same-origin policy blocks and allows, what CORS headers relax, and how CSRF tokens and SameSite cookies stop forged requests.
MCQ: 9
Fill-in: 8
Flashcards: 11
Pair match: 9
Locked · 37 questions inside
Broken Access Control and IDOR
How applications fail to check what a signed-in user is allowed to do, including IDOR and privilege escalation, and how to build checks that hold.
MCQ: 9
Fill-in: 7
Flashcards: 11
Pair match: 9
Locked · 36 questions inside
Authentication and Session Flaws
Common weaknesses in logins, sessions, tokens and password resets, such as credential stuffing, session fixation and JWT mistakes, and how to avoid them.
MCQ: 9
Fill-in: 7
Flashcards: 11
Pair match: 9
Locked · 36 questions inside
SSRF, Insecure Deserialization and File Upload Flaws
Three ways server code trusts the wrong thing: fetching URLs a user chose, rebuilding objects from untrusted data, and accepting uploaded files, with the defences for each.
MCQ: 9
Fill-in: 7
Flashcards: 11
Pair match: 9
Locked · 36 questions inside
Security Misconfiguration and Security Headers
Insecure defaults, leftover debug features and exposed files, and the HTTP response headers and cookie settings that harden a web application.
MCQ: 9
Fill-in: 7
Flashcards: 10
Pair match: 9
Locked · 35 questions inside
Secure SDLC and Software Supply Chain
Building security into how software is written and shipped: static, dynamic and dependency scanning, secrets scanning, security code review, and attacks on the packages you depend on.
MCQ: 9
Fill-in: 8
Flashcards: 11
Pair match: 9
Locked · 37 questions inside
6 more topics in this deck

Create a free account to open every topic — and play the whole deck without copying it.

Sign up freeLog in