Learning OWASP A01 and A02: Broken Access Control and Security Misconfiguration

By Samyuktha

Introduction

Not every learning exercise ends with a dramatic finding, and that's a fine outcome. This post walks through two OWASP Top 10 (2025) categories I studied hands-on via TryHackMe — A01: Broken Access Control and A02: Security Misconfiguration — and how I applied that thinking to a real, authorized production web application afterward.

The result on the real target wasn't a vulnerability. It was a clean pass. That turned out to be its own useful lesson about what a methodical assessment actually looks like.

Scope: This post covers concepts from two TryHackMe rooms plus a brief, authorized look at a production login/dashboard flow. No destructive testing, brute-forcing, or data modification was performed, and identifying details about the target have been omitted.