Web Application Penetration Testing
8-week guided certification in real-world web application penetration testing · industry-standard tools · verified certificate · 2 Months program · 8 guided weeks.
2 Months program · 3 months access · auto-graded weekly labs · certificate on completion.
Curriculum
Learn how the web really works, drive Burp Suite and ZAP, and enumerate an app the way an attacker does — observe first, exploit later.
SQL, NoSQL and command injection, plus SSTI and prompt injection — one root cause, many surfaces.
Weak passwords, credential stuffing, JWT forging, password-reset abuse and full account takeover.
Reflected, stored, DOM, HTTP-header and API XSS, plus Content Security Policy bypass.
IDOR/BOLA, privilege escalation, forced browsing, CSRF and SSRF — and chaining them.
REST & GraphQL APIs, XXE, vulnerable components and security misconfiguration.
Prompt injection (direct & indirect), system-prompt extraction, jailbreaking and the OWASP LLM Top 10.
An unguided CTF across Weeks 1-7, then the defender debrief and a professional pentest report.
Certificate of Completion
Finish all guided weeks and the capstone assessment to earn a verifiable certificate. Every certificate carries a unique ID checkable at /verify/<id>.
