04Web Application Penetration Testing

Hunt real web vulnerabilities with Burp Suite: the OWASP Top 10, XSS, SQL injection, CSRF, SSRF, command injection, file inclusion, XXE and access control.

  • 19 live classes
  • Taught in Telugu
  • 1 hour each
  • Certificate
Book a free demo See the syllabus Web App Pentesting syllabus (PDF) or download the full syllabus (all 8 courses)
Outcomes

After this course, you can…

01

Test a web app end to end with Burp Suite

02

Find and exploit the OWASP Top 10 and 20+ more bug classes

03

Write findings the way bug bounty programs and clients expect

Syllabus

Every topic you'll cover.

12 modules · 82 topics.

01Introduction to WAPT7 topics
  • What is web application penetration testing
  • Vulnerability assessment vs penetration testing
  • Bug hunting methodology
  • Web application vs website
  • DBMS architecture
  • URL structure
  • Lab setup: DVWA, bWAPP, OWASP WebGoat
02OWASP Top 10 (2021)10 topics
  • A01 Broken Access Control
  • A02 Cryptographic Failures
  • A03 Injection
  • A04 Insecure Design
  • A05 Security Misconfiguration
  • A06 Vulnerable and Outdated Components
  • A07 Identification and Authentication Failures
  • A08 Software and Data Integrity Failures
  • A09 Security Logging and Monitoring Failures
  • A10 Server-Side Request Forgery
03Burp Suite4 topics
  • Proxy configuration
  • Repeater
  • Web crawling
  • Target scanning
04Cross-Site Scripting (XSS)6 topics
  • JavaScript event handlers
  • Reflected XSS
  • Stored XSS
  • DOM-based XSS
  • Cookie theft with XSS
  • XSS exploitation
05SQL Injection7 topics
  • Error-based
  • Union-based
  • Blind: boolean-based and time-based
  • Manual injection
  • Automated scanning
  • Admin panel bypass
  • sqlmap
06Cryptographic Failures5 topics
  • ColdFusion vulnerability
  • BREACH attack
  • Heartbleed
  • Missing HSTS
  • POODLE attack
07Broken Authentication & Sessions6 topics
  • Credential stuffing
  • Improper admin login
  • Insecure login forms
  • Insecure logout
  • Session hijacking
  • Session ID exposed in the URL
08CSRF4 topics
  • Change email
  • Change address
  • Add to cart
  • CSRF exploitation
09SSRF4 topics
  • SSRF stock checker
  • SSRF to an internal API
  • Blind SSRF
  • Burp Collaborator
10Shell, Command Execution & File Inclusion5 topics
  • File upload vulnerabilities
  • Remote code execution
  • OS command injection
  • Local file inclusion (LFI)
  • Remote file inclusion (RFI)
11XXE (XML External Entity)7 topics
  • Introduction to XML and entities
  • Document Type Definitions (DTD)
  • XXE injection
  • Billion laughs (DoS)
  • XXE through file upload
  • XXE to remote code execution
  • XSS via XXE
12Additional Vulnerabilities17 topics
  • IDOR
  • Host header attacks
  • HTTP request smuggling
  • HTML injection
  • Open redirection
  • Path and directory traversal
  • Insecure CORS
  • Clickjacking
  • Missing rate limits
  • Parameter tampering
  • JWT attacks
  • Negative quantity
  • Race conditions (coupons)
  • Mass assignment
  • OTP bypass
  • Insecure deserialization
  • SSTI
Free live demo

See it live before you join.

Saturday 6–7 PM · Sunday 11 AM–12 PM · Sunday 7–8 PM (IST). Fees and batch dates are shared in the demo.

Book on WhatsApp +91 81250 59380