The ten most common ways web apps get hacked. Break a small shop four different ways (leaked file, SQL injection, access control, XSS), then fix each one and watch the attack stop. This interactive lesson needs JavaScript.
