Almost everything we use online runs on a web application, from banking to email to shopping. That makes them a favourite target, and one of the most common places for an ethical hacker to find real weaknesses. Most of these flaws come from the same few mistakes, which is why they are so well documented.
You'll start with the OWASP Top 10, the industry's list of the most critical web risks. Then you'll look closely at two of the most important attacks, SQL injection and cross-site scripting (XSS), and how developers defend against them. Finally you'll meet Burp Suite, the standard tool for intercepting and testing web traffic.
Only test applications you own or have written permission to test. Practising on deliberately vulnerable labs is the safest way to learn. Next you'll move on to Exploitation & Post-Exploitation, where you'll see what happens once a weakness has been found.
What OWASP is and a short tour of the Top 10 web application security risks, the starting point for web testing.
Three SQL injection attacks demonstrated step by step, showing how unsafe database queries can be abused.
How stored, reflected, and DOM XSS attacks work, and how defences like Content Security Policy stop them.
An introduction to Burp Suite for web application pentesting, including how to intercept and inspect requests.