I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding measures). The talk will be presented at the students of our computer science department and will last around one hour of theory followed by a demo/hands-on module (around 1 hour as well).
I want to ask for your suggestions on which topics do you think I should cover and how to demo some of them. I'm inclined to present the "TOP10 list of web security issues" by OWASP, talk about them and use the resources from "OWASP's guide to building secure web apps" for countermeasures and suggestions.
For hands-on lab I'm thinking of using a intentionally vulnerable app like WebGoat or something related. What are your thoughts? Thanks.