Web Application Pentesting
Find and exploit the flaws that top every real-world web risk list.
- Estimated time
- 3 hours
- Rooms
- 5 rooms
- Points
- 1320 pts
- Enrolled
- Be the first to enroll
About this path
Modern applications fail in recognisable ways: they trust the wrong input, they forget to check who is asking, and they hand attacker-controlled data to powerful back-end features. This path works through those failure modes one room at a time, mapped to the OWASP Top 10 and OWASP API Security Top 10, so you build a methodology you can take into a real engagement.
Who should start here
Learners who know their way around HTTP and JSON and want to move from "I understand the theory" to confidently finding broken access control, injection and authentication flaws in web and API targets.
Prerequisites
Comfort with HTTP requests and responses, JSON, and a tool such as a browser's dev tools or curl. The Pre-Security path (or equivalent) is recommended first.
What you will be able to do
- Test for and exploit broken access control (IDOR / BOLA and function-level gaps)
- Identify authentication flaws such as JWT algorithm confusion
- Exploit server-side template injection and reach code execution
- Map and attack a GraphQL API through introspection and batching
- Chain a discovery flaw into an access or execution flaw the way real attackers do
Curriculum
Module 1 — Broken access control0 of 2 rooms complete
The most common web risk: asking without being checked.
Module 2 — Broken authentication0 of 1 rooms complete
When a token says more than it should.
Module 3 — Injection to code execution0 of 2 rooms complete
Attacker input reaching a powerful interpreter.