0%

Explore Courses Defend What Matters

English 日本語
$ USD ¥ JPY
Contact Us
0
Sign In Create Account
Start Learning

Your Bag

Web Application Penetration Testing

04 Penetration Testing

Web Application Penetration Testing

Find and prove the vulnerabilities that matter in modern web applications, from injection and broken access control to logic flaws.

Levels
04
Skill Range
Beginner → Expert
Track
Penetration Testing
Lifetime Access
Enroll Now Explore Courses
Web Application Penetration Testing
From 239CREDS

Web applications are where most organisations expose themselves, and where most bug bounty money is paid. This course works through the OWASP Top 10 as a starting point rather than a checklist. You will test injection across SQL, NoSQL, and command contexts, break authentication and session handling, and dig into broken access control, which remains the most common serious finding and the one scanners miss. Cross-site scripting is covered in all three forms alongside CSRF, SSRF, insecure deserialisation, and file upload abuse. Business logic flaws get their own treatment because no tool finds them. You will work in Burp Suite throughout, and finish with a full report against a realistic target application.

Curriculum

Learning Path

Each level is enrolled separately. Work through them in order, or start at the level that matches your experience.

  1. Level 01

    Beginner

    239 CREDS

    Purpose

    Test injection, the flaw class that still causes the most serious web findings.

    Outcome

    You can find and prove injection flaws safely.

    What You'll Learn
    • Find and confirm SQL injection in a lab application without damaging data.
    • Extend the same reasoning to NoSQL and command injection contexts.
    • Map where user input reaches an interpreter unescaped.
  2. Level 02

    Intermediate

    482 CREDS

    Purpose

    Break authentication and session handling, the controls everything else on the site trusts.

    Outcome

    You can compromise a session and explain exactly which control failed.

    What You'll Learn
    • Attack weak login flows, password reset, and account recovery.
    • Analyse session tokens for predictability and improper invalidation.
    • Chain a session flaw into access you should not have.
  3. Level 03

    Advanced

    695 CREDS

    Purpose

    Exploit broken access control, the most common serious finding and the one scanners miss.

    Outcome

    You can find access control flaws that automated tools do not report.

    What You'll Learn
    • Test for horizontal and vertical privilege escalation across user roles.
    • Find insecure direct object references by manipulating identifiers.
    • Cover cross-site scripting, CSRF, and SSRF where they enable access abuse.
  4. Level 04

    Expert

    1,068 CREDS

    Purpose

    Find business logic flaws, which no tool detects because they are specific to the application.

    Outcome

    You can find and report the logic flaws unique to an application.

    What You'll Learn
    • Abuse a multi-step workflow by taking the steps out of order.
    • Manipulate quantities, prices, and state to reach an unintended result.
    • Run a full engagement in Burp Suite and report against a realistic target.