25. Break and fix common web app flaws
Test web applications for broken access control, injection, cross-site scripting, insecure deserialization, SSRF, file upload flaws, and session problems. You will connect OWASP-style findings to safe fixes developers can act on.