· 3 min read

OWASP Top 10 Flashcards: Study the 2021 List and Update It for 2025

Study OWASP Top 10 with 35 flashcards on injection, SSRF, SAST, DAST, IAST and RASP, then add the missing #1 risk and the new OWASP 2025 ranking.

Shield with a padlock protecting a browser window, with a bug and a key

Studying. But it's also a video game. 🎮

Flashcards, quizzes and games that make you actually remember.

Start playing — it's free

Posted by

Most people study the OWASP Top 10 as a list to recite. The better approach is to learn each risk with its rank, its year and one concrete example — because the ranking changes. The Flip It deck Web Security: OWASP & Authentication (code JR8789, 35 cards) is built on the 2021 list, and OWASP published a new edition in late 2025. Here is what the deck teaches and how to update it.

Study this deck: Web Security: OWASP & Authentication

1 / 10
Question

OWASP

Knew itLearning

Tap the card for the answer · swipe right if you knew it, left if not

Sample cards

FrontBack
Injection in the context of web securityUntrusted data sent to an interpreter as part of a command or query, ranked #3
Insecure designMissing or ineffective security controls in the architecture and design phase, ranked #4
SSRFServer-Side Request Forgery: the server performs unintended requests, ranked #10 in 2021
SASTAnalyzes source code before the application is executable (white-box)
DASTDetects vulnerabilities by crawling a running website (black-box)
IASTInstruments the application from within, combining SAST and DAST
Disadvantage of SASTMany false positives that must be verified manually
FuzzingFeeding invalid, unexpected or random data as input
RASPIntrusion detection and prevention from inside the application runtime

What the 35 cards cover

OWASP Foundation (501(c)(3), 2004), cryptographic failures, injection, insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failures, software and data integrity failures, logging and monitoring failures, SSRF, AppSec, SAST, DAST, IAST, fuzzing, RASP, software composition analysis, OWASP ZAP, WebGoat, ASVS, threat modeling, white-box and black-box testing, bug bounty platforms, the Testing, Code Review and Development guides, the Gen AI Security Project (May 2023), the API Security Project, CI/CD pipelines.

Tip 1: write the missing #1 and the 2025 ranks

The deck ranks #2 to #10 but has no card for #1, Broken Access Control — the top risk in both 2021 and 2025. Write it first (IDOR, missing authorization checks, privilege escalation). Then add the year to each rank card, and a second card for the OWASP Top 10:2025:

  1. Broken Access Control (now includes SSRF)
  2. Security Misconfiguration
  3. Software Supply Chain Failures
  4. Cryptographic Failures
  5. Injection
  6. Insecure Design
  7. Authentication Failures
  8. Software or Data Integrity Failures
  9. Security Logging and Alerting Failures
  10. Mishandling of Exceptional Conditions (new)

Also fix card 3: the Top 10 is not annual. Editions came out in 2003, 2004, 2007, 2010, 2013, 2017, 2021 and 2025.

Tip 2: the "Authentication" in the title is one card

Only card 26 covers authentication. If you're preparing an interview or a security exam, add 5-6 cards on password hashing (bcrypt, Argon2), MFA, session fixation, JWT expiry and revocation, OAuth 2.0 vs OpenID Connect, and credential stuffing. Then drill the testing cards 11-24 as contrasts: SAST vs DAST vs IAST, white-box vs black-box, SCA vs fuzzing.

The deck is in the Flip It library under code JR8789 at flip-it.app. Continuing with APIs? See the REST, GraphQL and HTTP status codes study plan, or go further with the Security+ SY0-701 flashcards.

Ready to learn faster? 🚀

Join FLIP IT for free and turn studying into a game.

Create my free account