Web Application Pentesting
Find and exploit the flaws that top every real-world web risk list.
- الوقت المتوقّع
- 3 ساعات
- الغرف
- 5 غرف
- النقاط
- 1320 نقطة
- المسجّلون
- كن أول المسجّلين
عن هذا المسار
Modern applications fail in recognisable ways: they trust the wrong input, they forget to check who is asking, and they hand attacker-controlled data to powerful back-end features. This path works through those failure modes one room at a time, mapped to the OWASP Top 10 and OWASP API Security Top 10, so you build a methodology you can take into a real engagement.
لمن هذا المسار
Learners who know their way around HTTP and JSON and want to move from "I understand the theory" to confidently finding broken access control, injection and authentication flaws in web and API targets.
المتطلّبات المسبقة
Comfort with HTTP requests and responses, JSON, and a tool such as a browser's dev tools or curl. The Pre-Security path (or equivalent) is recommended first.
ما الذي ستتمكّن من فعله
- Test for and exploit broken access control (IDOR / BOLA and function-level gaps)
- Identify authentication flaws such as JWT algorithm confusion
- Exploit server-side template injection and reach code execution
- Map and attack a GraphQL API through introspection and batching
- Chain a discovery flaw into an access or execution flaw the way real attackers do
المنهج
الوحدة 1 — Broken access controlاكتملت 0 من 2 غرف
The most common web risk: asking without being checked.
الوحدة 2 — Broken authenticationاكتملت 0 من 1 غرف
When a token says more than it should.
الوحدة 3 — Injection to code executionاكتملت 0 من 2 غرف
Attacker input reaching a powerful interpreter.