The Top-10 is just a start. As a penetration tester and sometimes-trainer, I find it's when developers start to see practical demonstrations of what these vuln

The Top-10 is just a start. As a penetration tester and sometimes-trainer, I find it's when developers start to see practical demonstrations of what these vulnerabilities can actually allow a malicious party to achieve that the eyes really get opened. Particularly when those demonstrations are within their own applications. Check out the rest of the OWASP site, and play with WebGoat (http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project http://www.owasp.org/index.php/Category:OWASP_WebGoat_Projec...). Take a look at the 'Web Security' section here: http://code.google.com/edu/courses.html http://code.google.com/edu/courses.html Start following some of the many webappsec blogs floating around the interwebs, subscribe to mailing lists, read tweets: http://www.gnucitizen.org/ http://www.gnucitizen.org/ http://ha.ckers.org/ http://ha.ckers.org/ http://jeremiahgrossman.blogspot.com/ http://jeremiahgrossman.blogspot.com/ http://www.webappsec.org/lists/websecurity/ http://www.webappsec.org/lists/websecurity/ http://twitter.com/#search?q=%23WebAppSec http://twitter.com/#search?q=%23WebAppSec There is a huge amount of information out there.