Web Application Penetration Tester
Test a web application end to end and write a finding a developer can act on without asking you a follow-up question.
- Level
- Beginner
- Modules
- 6
- Lessons
- 57
- Time
- 46h
The path assumes you can use a browser and read HTTP, and takes you to the point where you can run a scoped web application assessment on your own. It is ordered the way an assessment is ordered: map the surface, understand the authorisation model, then attack the places where the two disagree. Reporting is a module rather than an afterthought, because an unreported finding and an unfound one are worth the same.
Roles and prerequisites
Roles
- Penetration tester
- Application security engineer
- Developer
Aligned with
- PortSwigger BSCP
- OffSec OSWA
Before you start
- Comfortable reading an HTTP request and response
- Basic command line on Linux or macOS
- No prior security experience required
The modules, in order
Order is the pedagogy here rather than a gate. Each module assumes the one before it.
HTTP and the intercepting proxy
What actually crosses the wire, and how to see it. Sets up the proxy, the browser, and the habit of reading a request before touching it.
9 lessons · 4h 40m
Mapping the attack surface
Content discovery, parameter discovery, and the difference between an endpoint that exists and one that is reachable.
7 lessons · 3h 10m
Authentication and sessions
Credential handling, session lifecycle, multi-factor bypass classes, and why "logout" is a state machine question.
11 lessons · 5h 0m
Access control
Vertical and horizontal authorisation, object-level checks, and the reason most access control bugs are found by reading two responses side by side.
10 lessons · 5h 40m · 1 lab
Server-side attack classes
Injection, deserialisation, template evaluation, and request forgery from the server position.
14 lessons · 7h 0m · 1 lab
Reporting and impact
Turning a reproducible request into a finding with a severity a triager will not argue with, and a remediation a developer can ship.
6 lessons · 3h 40m
What you will be able to do
- HTTP request analysis
- Authentication and session testing
- Access control testing
- Injection classes
- Server-side request forgery
- Finding write-up and impact demonstration
Terms this path relies on
Free to read, no account needed. Worth skimming before module one.
Cyber VK Security Curriculum
Pre-publication content owner
Internal ownership label for the web-security curriculum.
Technically reviewed by Cyber VK Defensive Research
Updated