Nine out of ten web applications have security vulnerabilities. These vulnerabilities affect not only traditional websites but also modern single-page applications and APIs. This makes web security a crucial topic to explore: What are the most common and effective attacks on web applications, what countermeasures can be implemented, and which emerging threats could pose significant risks in the future?Alongside well-known attacks like cross-site scripting (XSS) and cross-site request forgery (CSRF), newer threats such as server-side request forgery (SSRF) and methods to secure single-page applications will also be addressed. Most attacks exploit common features across web applications, including HTTP, JavaScript, SQL, and more. Consequently, this workshop takes a technology-agnostic approach to understanding and mitigating these dangers.