Web Application Security
Learn to find, prove and fix the most common web application weaknesses, from the OWASP Top 10 to proxy-based testing and secure coding, always within authorised, training-only scope.
- Courses
- 2
- Study time
- 18 hours
- Lessons
- 9
- Practice labs
- 6
- Assessments
- 4
Courses in this path
Take them in this order. Each one has lessons, practice labs and an assessment.
OWASP Top 10 in Practice
Work through the OWASP Top 10 (2021) with a focus on broken access control, injection, XSS, authentication failures, misconfiguration and SSRF.
4 lessons, 3 labs, 2 assessments
View course →Web Testing with Burp Suite & Secure Coding
Use an intercepting proxy to observe, replay and assess web traffic, then turn findings into fixes: parameterised queries, output encoding, CSP,…
5 lessons, 3 labs, 2 assessments
View course →What you will be able to do
A sample of the skills the courses in this path teach.
- Name the OWASP Top 10 2021 categories and map a described flaw to the correct category
- Identify an IDOR / broken access control pattern from access logs and state the server-side fix
- Configure the concept of an intercepting proxy with a scope limited to an authorised target
- Review captured HTTP traffic and identify missing headers, cookie flaws, information leaks and authorisation gaps
Before you start
Basic understanding of HTTP (methods, status codes, cookies) and some programming experience
Finish every lesson, lab and assessment of a course and you can claim a digitally signed certificate. Finish every course in the path and you can claim a path certificate too.