Building OWASP BLT University: An Interactive Security Learning Platform

Description and use

Development of the OWASP BLT University interactive security learning platform during GSoC. Includes 13 labs, 5 courses, and a vulnerability dashboard based on static data.

Problem

Need for an interactive, static learning platform to teach web security concepts (SQLi, XSS, CSRF, IDOR) with immediate feedback, progress tracking, and real-world vulnerability context.

Outcome

Successfully built a comprehensive static learning platform with 13 interactive labs, 5 courses, and a live vulnerability dashboard, enabling users to learn security concepts through hands-on simulation and real-world data.

Workflow

• Developed interactive simulations for SQL injection, XSS, CSRF, and IDOR using an Identify, Explain, Fix flow.
• Implemented lab structure, validation scripts, contributor guides, and reusable templates.
• Integrated NVD and CISA vulnerability data pipelines to generate a 90-day dataset for the Security Trends dashboard.
• Built a dashboard with charts, search, filters, and CVE explorer linked to lab recommendations.
• Created learning tracks (Cyber Hygiene, Professional Security) with adaptive recommendations and progress tracking.
• Implemented AST validation for JavaScript answers to ensure code correctness beyond keyword matching.
• Added cross-browser tests and saved progress functionality using local storage.

Evidence

BLT University is now a static, interactive learning platform with 13 labs, five courses, two tracks, and a dashboard built from recent public vulnerability records.

Source

Added AST validation for JavaScript lab answers, tests that reject unrelated code containing expected security keywords.

Source