Most of today’s services live on the web, which makes web applications one of the main targets of attackers and one of the best places to learn how security really works. In this course you will learn to examine an application the way a professional tester does: with a method, a notebook and a deep respect for the law.
You will set up an isolated lab with an intercepting proxy and a training application such as DVWA or OWASP Juice Shop, then audit it chapter by chapter: authentication, injections, client-side flaws, access control and business logic, configuration and components. Each topic combines concepts, safe hands-on exercises and the matching fixes. You will finish by writing a professional vulnerability report, rating severity with CVSS and understanding responsible disclosure and bug bounty.
Every exercise takes place in legal training environments. No real target, no ready-to-use exploit: the goal is to understand, test responsibly and help fix.
What you will learn
- Explain a web testing methodology (OWASP WSTG) and set up a safe, isolated lab with Burp Suite and a legal training application
- Map an application: entry points, parameters, roles and technologies
- Test authentication, sessions, password reset and multifactor flows and recognise their typical weaknesses
- Understand SQL and other injections, reproduce the detection in a lab and apply prepared statements and server-side validation
- Distinguish reflected, stored and DOM-based XSS, CSRF and clickjacking, and apply output encoding, tokens and security headers
- Test access control (IDOR, privilege escalation), reason about business logic flaws and understand SSRF
- Review server configuration, dependencies, file uploads and deserialization risks
- Write a clear vulnerability report, rate and prioritise findings with CVSS, and follow responsible disclosure and bug bounty rules
Prerequisites
Having completed “Technical fundamentals: networks, Linux and systems”, or being comfortable with the basics of networks, the command line and cryptography. A computer able to run a virtual machine or a container is recommended.