Offensive SecurityBeginner~6 months

Web Security

Learn to identify and exploit web application vulnerabilities including XSS, SQL Injection, CSRF, SSRF, and more.

10 Topics

Key concepts

3 Levels

Beginner to Advanced

5 Tools

Curated for this track

8 Questions

Test yourself

Start learningTake the quizAll tracks

About this track

Break and defend the applications everyone depends on.

Web security is the highest-volume specialisation in the industry: almost every organisation runs web applications, and almost every one of them has bugs. This track takes you from understanding how an HTTP request is put together to chaining subtle logic flaws into full account takeover.

You will spend most of your time with a proxy in front of a deliberately vulnerable application, learning to read requests the way an attacker does. The roadmap starts with the OWASP Top 10 as a map of the territory, then goes deep on the classes that actually pay: injection, access control, and server-side request handling.

By the end you should be comfortable picking up an unfamiliar application, mapping its attack surface methodically, and writing up what you find in a way a developer can act on.

Key topics

10 topics grouped into three modules, in the order you should meet them.

  1. 01

    Foundations

    4 topics
    • 1.

      OWASP Top 10

      The industry's shared vocabulary for web risk — learn it as a checklist of where to look, not as a ceiling.

    • 2.

      SQL Injection

      Coercing a database into running your query. Still present wherever string concatenation meets user input.

    • 3.

      Cross-Site Scripting (XSS)

      Getting your JavaScript to run in someone else's session. Reflected, stored, and DOM variants each need a different hunt.

    • 4.

      Cross-Site Request Forgery (CSRF)

      Making a victim's browser send an authenticated request they never intended.

  2. 02

    Core exploitation

    4 topics
    • 5.

      Server-Side Request Forgery (SSRF)

      Turning the server into your proxy — the fastest route into cloud metadata and internal networks.

    • 6.

      Authentication Bypass

      Logic flaws in login, session, and reset flows that skip the credential check entirely.

    • 7.

      Insecure Deserialization

      Untrusted bytes turned back into live objects, frequently landing on remote code execution.

    • 8.

      File Upload Vulnerabilities

      Getting a payload onto disk and then getting the server to execute it.

  3. 03

    Advanced & chaining

    2 topics
    • 9.

      API Security

      REST and GraphQL move the same bugs behind a different shape — mass assignment, BOLA, and over-fetching.

    • 10.

      Web Application Firewalls

      How filtering works, where it breaks, and why a WAF is a speed bump rather than a fix.

What you'll be able to do

  • Map an unfamiliar web application's full attack surface and prioritise where to look first
  • Find and exploit injection, access-control, and SSRF classes by hand, not just with a scanner
  • Use Burp Suite fluently, including Repeater, Intruder, and custom match-and-replace rules
  • Write a vulnerability report a developer can reproduce and fix without a follow-up call