Advanced Web Application Penetration Testing (WAPT)

What You Get

Full Course Curriculum

26 modules, from HTTP fundamentals to a guided bug bounty simulation internship.

Module 1: Web Architecture & HTTP/HTTPS In-Depth

Client-server model, REST APIs, JSON/XML data formats, HTTP request/response headers, and status code mechanics.

Module 2: Session & State Management

Cookies, flags (Secure, HttpOnly, SameSite), sessions vs. JWTs, local storage, and caching security.

Module 3: Interception Proxies with Burp Suite Pro

Scope configuration, match & replace rules, Proxy listeners, Repeater workflows, and essential BApp extensions.

Module 4: Burp Suite Intruder & Automated Fuzzing

Payload types (Sniper, Battering Ram, Pitchfork, Cluster Bomb), payload processing, and grep-match extraction.

Module 5: Web Application Reconnaissance & Mapping

Content discovery (Gobuster, ffuf), directory fuzzing, virtual host discovery, spidering, and technology profiling (Wappalyzer).

Module 6: SQL Injection: In-Band & Error-Based

Identifying entry points, DBMS error extraction, column mapping, UNION-based data extraction across MySQL/PostgreSQL/MSSQL.

Module 7: SQL Injection: Blind, Time-Based & Out-of-Band

Boolean-based blind extraction, time-delay functions (SLEEP, WAITFOR DELAY), and automated exploitation using SQLMap.

Module 8: Cross-Site Scripting (XSS): Reflected & Stored

Context-aware payload crafting (HTML, attribute, JavaScript contexts), input filter bypasses, and session cookie exfiltration.

Module 9: DOM-Based XSS & Web Storage Attacks

DOM sinks and sources (location.hash, eval, innerHTML), prototype pollution fundamentals, and abusing client-side storage.

Module 10: Content Security Policy (CSP) & Defense Bypass

CSP directives, nonce/hash configurations, and practical bypass techniques using wildcard endpoints or JSONP.

Module 11: Cross-Site Request Forgery (CSRF) & SameSite Policy

Proof-of-concept creation, token validation flaws, CSRF token bypasses, and SameSite attribute edge cases.

Module 12: Cross-Origin Resource Sharing (CORS) Misconfigurations

Origin reflection, null origin trust, pre-flight options handling, and cross-domain data theft.

Module 13: Broken Authentication & Credential Stuffing

Password spraying, brute-force bypasses, 2FA/MFA implementation logic flaws, and rate-limit circumvention.

Module 14: JSON Web Token (JWT) Exploitation

Algorithm confusion attacks (none, HMAC-SHA to RSA), signature stripping, key-injection, and weak secret brute forcing.

Module 15: Broken Object Level Authorization (BOLA/IDOR)

Insecure direct object references, numeric/UUID enumeration, privilege horizontal/vertical cross-access flaws.

Module 16: Broken Function Level Authorization (BFLA)

Administrative endpoint brute forcing, verb tampering (GET vs. POST vs. PUT), and role assignment manipulation.

Module 17: Local & Remote File Inclusion (LFI/RFI)

Directory traversal path truncation, null byte injection, PHP wrappers (php://filter, php://input), and RCE via log poisoning.

Module 18: Arbitrary File Upload Flaws

MIME type spoofing, blacklisted/whitelisted extension bypasses, .htaccess overriding, polyglot files, and web shell deployment.

Module 19: Server-Side Request Forgery (SSRF)

Internal service discovery, localhost/loopback bypassing, DNS rebinding, and cloud metadata theft (AWS 169.254.169.254, GCP).

Module 20: Server-Side Template Injection (SSTI)

Template engine detection (Jinja2, Twig, Freemarker, Thymeleaf), syntax probing, and sandbox escape to remote code execution.

Module 21: XML External Entity (XXE) Attacks

DTD basics, out-of-band data exfiltration, local file disclosure, and blind XXE parameter entity exploitation.

Module 22: REST & GraphQL API Penetration Testing

API fuzzing with Postman/Burp, schema introspection, batching attacks, query depth abuse, and GraphQL injection.

Module 23: Business Logic & Workflow Vulnerabilities

Race conditions, parameter pollution (HPP), rounding errors, checkout step skipping, and gift card/promo code replay.

Module 24: Web Application Firewall (WAF) Detection & Evasion

WAF fingerprinting, chunked transfer encoding, URL/Unicode encoding variants, and payload fragmentation.

Module 25: Secure Code Auditing & Developer Remediation

Static Application Security Testing (SAST) basics, parameterized query enforcement, context-aware output encoding.

Module 26: Capstone Project & Guided WAPT Internship

Project: Conduct a full-scope pentest against an enterprise SaaS web app with microservices, GraphQL APIs, and role-based access controls.
Internship: 4-week bug bounty simulation - triaging vulnerabilities, reporting reproducible exploits, and validating developer patches.

Become An Advanced
Web App Penetration Tester