Course Overview

Welcome to this complete course about web application penetration testing. The course doesn’t require any prior knowledge of testing web applications for security vulnerabilities nor it requires any level of coding knowledge although it’s preferred.

This course covers web application vulnerabilities in a practical fashion using practical labs designed for demonstrations. The course contains a theoretical part to explain the concepts and a practical part for demonstration. Course theoretical part is packed into a downloadable PDF file as well.

You will learn everything by doing and the course shows practical demonstrations on vulnerable systems designed for practicing your skills in web application penetration testing.

Course Contents | The Complete Practical Web Application Penetration Testing Course

  • Introduction to Injection Vulnerabilities
  • SQL Injection – Authentication Bypass
  • SQL Injection – Error Based
  • SQL Injection – Blind Boolean Based
  • SQL Injection – Blind Time Based
  • SQL Injection with SQLmap
  • Command Injection
  • Broken Authentication
  • Sensitive Data Exposure
  • Broken Access Control
  • SSRF – Server Side Request Forgery
    XSS – Cross Site Scripting
    CSRF – Cross Site Request Forgery
    SSTI – Server Side Template Injection
    XXE – XML External Entity Injection
    JWT – Json Web Token Vulnerabilities

Testimonials (LinkedIn)

How to Buy The Complete Practical Web Application Penetration Testing Course?

You can buy the booklet directly by clicking on the button below

Get The Course

How many videos do the course include?

The Web Application Penetration Testing Course Course contains over all 18 Videos with a duration of 4-5 hours of educational content.

What You Will Learn in This Course -The Complete Practical Web Application Penetration Testing Course

· Understand Web application penetration testing methodology

· Understand the concepts of web application vulnerabilities

· Be able to conduct manual testing of web application vulnerabilities


  • Basic knowledge about the web.

  • No programming is needed

What are OWASP TOP 10 Vulnerabilities?

1- Injection vulnerabilities: Injection vulnerabilities are very common in today’s websites. In this section you will get to understand what causes an injection vulnerability and be able to uncover its existence by looking through and testing the right parts in any web application. In injection vulnerabilities we cover the below categories

· SQL Injection: Most common vulnerabilities against databases. You will learn the different types of SQL injection vulnerabilities in addition to the ability to test and uncover a SQL injection by performing practical exercises against vulnerable pages.

· SQLmap: After you learned how to manually test for SQL injection, here you will learn how to automate your testing using one of the most popular tools used in SQL injection

· Command Injection: Command injections comes as one of the most dangerous web application vulnerabilities as it allows for complete takeover the system. In this section, you will learn how to spot a command injection vulnerability and how to perform a proof of concept.

2- Broken Access Control: This vulnerability also comes in the OWASP top 10 list as of 2022. We will cover to reveal weakness areas in a website that would allow unrestricted access to sensitive resources.

3- Broken Authentication: This section will teach you how to bypass authentication methods such as login forms.

4- JSON Web Tokens: JWTs are not considered as a web application vulnerability rather a kind of cookies used for authorization. In this section we will go through the process of showing the mechanisms of testing and exploiting these tokens.

5- Sensitive Data Exposure: This section will reveal techniques that are used to see if a website has security measures against data leaks.

6- SSRF aka server side request forgery: One of the recently added vulnerabilities to the OWASP top 10 list. You will learn how to use it make a website reveal sensitive resources and load internal running services.

7- SSTI aka server side template injection: not commonly talked about but this section explains how such vulnerability may lead to devastating outcomes such as command injection and full system takeover.

8- XSS aka Cross Site Scripting: Very well known and popular web application vulnerability. In this section we will practically explain Stored, Reflected and DOM-based XSS.

9- XXE aka XML External Entity Injection: a vulnerability that occurs as a result of poor XML implementation. We will explain how XML works and see different techniques to exploit XXE.

10- CSRF aka Cross Site Request Forgery: Very popular vulnerability that when exploited allows for unauthenticated actions against users. We will learn practically how to perform and setup a testing environment to uncover CSRF.

Free Web Application Penetration Testing Training

Checkout the playlist below on my YouTube channel for Free Web Application Penetration Testing Training