A lab-driven course on breaking web applications and explaining how to fix them — from HTTP fundamentals and reconnaissance, through the full injection and client-side surface, to request smuggling, deserialization chains, business-logic races, and white-box source review. Every attack is paired with how a defender detects it and how a developer prevents it.
Curriculum home: Armour Infosec Vault
| Property | Value |
|---|---|
| Course Title | Advanced Web Application Security Testing |
| Folder | Advanced-Web-Application-Security-Testing/ |
| Tag | Advanced Web Application Security Testing |
| Slug | web-sec |
| Level | Intermediate to Advanced |
| Focus | Offensive web application security |
| Modules | 17 teaching modules + 4 applied-practice collections |
| Delivery | Self-paced notes + hands-on labs |
| Language | English |
Note
What this course is
A study-and-practice track built as an Obsidian knowledge base. Each module is a folder with its own Readme hub and a set of deep-dive notes containing tagged, copy-ready HTTP, SQL, PHP, JavaScript, and shell snippets. It is designed to be read in order but is fully cross-linked for reference use during an engagement.
Warning
Educational use only Every technique here is documented at a study / detection / remediation level for use only against applications you own or are explicitly authorized to test — your own lab, a deliberately vulnerable target, a CTF, or an authorized engagement. Run the labs against the disposable local range described in Practical Labs, never against systems you do not control. Payload collections in this course are testing references, not licence to use them.
- 16 teaching modules in seven progressive stages, plus four applied-practice collections
- 491 notes, each structured: overview → how it works → finding it → exploitation → impact → detection → remediation → references → related
- 15 hands-on labs and a reusable lab template · 5 capstone mini-projects
- 336 spaced-repetition flashcards across 7 decks
- 4 certification coverage maps — PortSwigger Web Security Academy, eWPTX, OSWE, BSCP
- Architecture and flow diagrams (Mermaid — GitHub renders these inline)
- On GitHub — Markdown, Mermaid diagrams and alert callouts render inline, and the module links below are clickable, so you can browse the whole course here.
- Best experience: Obsidian — clone the repo and open the folder as a vault. Notes below this page use
[[wikilinks]], so Obsidian gives you backlinks and the graph view the notes were designed around.
- Verified or omitted. No CVE number, version range, tool flag or endpoint appears unless it was checked against NVD, a vendor advisory, official documentation, or the tool's own
--help. Where a specific could not be verified, the technique is described generically rather than guessed at. - Captured vs documented output. Labs built against a target that was actually run say so and show real captured output. Labs written from a project's published behaviour say that, and mark illustrative output as illustrative.
- Tools not installed on the authoring machine are named as such, with options attributed to project documentation rather than invented.
Note
Cross-course references These notes were extracted from a larger vault. References that pointed to other courses in that vault — API protocol testing, defensive PHP implementation, cloud, reconnaissance — were rendered as bold plain text during extraction. They have no target in this repository and are not broken links.
Web applications are where most organisations are actually attacked, and where the gap between "scanner found nothing" and "an attacker got in" is widest. This course teaches the manual tradecraft that closes that gap: reading an application's structure, finding the inputs that reach a dangerous sink, proving impact, and writing it up so it gets fixed.
The approach is deliberately two-sided. Every vulnerability note covers the flaw, a working exploitation path, the detection signal a defender would see, and the remediation that actually removes the bug rather than filtering the payload. That pairing is what separates a tester who reports findings from one whose findings get fixed.
By the end of this course you will be able to:
- Map an application's attack surface — entry points, parameters, endpoints, and trust boundaries.
- Drive Burp Suite and the ProjectDiscovery toolchain as a working methodology, not a set of buttons.
- Find and exploit the full injection surface: SQL, OS command, code, XPath, and template injection.
- Exploit client-side flaws — XSS in all three forms, CSRF, CORS misconfiguration, and open redirects.
- Attack server-side request handling: SSRF, Host-header abuse, and file inclusion to RCE.
- Break authentication, session management, and access control, including multi-step and role-based logic.
- Exploit deserialization chains, XXE, and JWT/OAuth/SAML implementation flaws.
- Understand and demonstrate HTTP request smuggling and cache poisoning.
- Identify business-logic and race-condition flaws that no scanner will ever find.
- Review source code for vulnerabilities white-box, tracing untrusted input from source to sink.
- Explain every finding in terms a defender and a developer can act on.
The 17 modules are sequenced into seven progressive stages, plus applied practice. Complete each stage before advancing — the later exploitation modules assume the HTTP, tooling, and methodology grounding from the first two.
Stage 1 Foundations ............ Web Application Fundamentals · Methodology
Stage 2 Discovery .............. Recon & Mapping · Tooling
Stage 3 Identity & Access ...... Authentication · Session Management · Access Control
Stage 4 Injection & Client ..... Injection · Client-Side Attacks
Stage 5 Server-Side & Data ..... Server-Side Attacks · File Handling · Serialization & Templating
Stage 6 Protocol & Modern ...... HTTP Desync & Caching · Modern Web & API Attacks
Stage 7 Logic, Crypto & Code ... Business Logic & Races · Cryptography & Config · Secure Code Review
Stage 8 Applied Practice ....... Labs · Mini-Projects · Flashcards · Exam Preparation
flowchart LR
A[Foundations] --> B[Discovery]
B --> C[Identity & Access]
C --> D[Injection & Client-Side]
D --> E[Server-Side & Data Handling]
E --> F[Protocol & Modern Surface]
F --> G[Logic, Crypto & Code Review]
G --> H[Applied Practice]
Important
Prerequisite chaining Stage 5 and Stage 6 assume you can read a raw HTTP request and reason about how a proxy, cache, and origin server each parse it — that is Stage 1. Attempting request smuggling or cache poisoning without it will leave you copying payloads rather than understanding them.
| Requirement | Level | Notes |
|---|---|---|
| HTTP and web technologies | Working | Requests, responses, headers, status codes, cookies |
| HTML, CSS, JavaScript | Reading | Enough to read page source and follow a script |
| Linux command line | Comfortable | Pipes, grep, file handling, running Go/Python tools |
| A server-side language | Helpful | PHP or Python; needed in earnest for Secure Code Review |
| SQL | Basic | SELECT, WHERE, UNION, and how a query is built |
| Networking | Basic | DNS, TCP, TLS, proxies |
| Component | Recommended | Purpose |
|---|---|---|
| Intercepting proxy | Burp Suite (Community or Professional) | Core testing tool throughout |
| Browser | Firefox or Chromium, dedicated testing profile | Proxied browsing, DevTools |
| Container runtime | Docker + Docker Compose | Runs the vulnerable target range |
| Recon toolchain | subfinder, httpx, katana, nuclei, ffuf | Discovery and scanning |
| Scripting | Python 3 | Custom tooling and exploit scripts |
| Virtualisation | VirtualBox / VMware / KVM | Isolated lab network |
| Role | Suggested | Purpose |
|---|---|---|
| Attacker | Kali Linux (VM or container) | Tooling and proxy |
| Targets | DVWA, OWASP Juice Shop, WebGoat, bWAPP | Broad vulnerability coverage |
| Targets | PHP open-source projects | Realistic source-review practice |
| Network | Host-only or internal, no production route | Containment |
Setup notes live in Vulnerable Web Application Lab Setup.
Caution
Keep every target on an isolated network segment. A deliberately vulnerable application reachable from the internet will be compromised and used against others.
Seventeen teaching modules grouped into seven progressive stages, each linking to the module's own Readme hub — plus the Practical Labs, Mini Projects, Flashcards, and Exam Preparation collections.
| # | Module | Focus |
|---|---|---|
| 1 | Web Application Fundamentals | HTTP, application architecture, entry points, parameters, OWASP, verification checklist |
| 2 | Methodology | WSTG-anchored testing method: engagement scoping, the 12 WSTG categories in testing order, evidence and reporting |
| # | Module | Focus |
|---|---|---|
| 3 | Recon & Mapping | Subdomain enumeration, probing, crawling, URL discovery, JavaScript analysis, bug-bounty scoping |
| 4 | Tooling | Burp Suite, extensions, Logger++, the working toolchain |
| # | Module | Focus |
|---|---|---|
| 5 | Authentication Testing | Username enumeration, brute force, 2FA bypass, password reset flaws |
| 6 | Session Management | Cookies, session attributes, fixation, hijacking |
| 7 | Access Control Testing | IDOR, role manipulation, URL/method/referer bypass, multi-step flaws |
| # | Module | Focus |
|---|---|---|
| 8 | Injection | SQL injection (error, blind, double-query, out-of-band), OS command, code, XPath |
| 9 | Client-Side Attacks | XSS, CSRF, HTML injection, CORS, CSP bypass, open redirects |
| # | Module | Focus |
|---|---|---|
| 10 | Server-Side Attacks | SSRF, Host-header attacks, routing-based SSRF |
| 11 | File Handling | Local and remote file inclusion, LFI to RCE, file upload flaws |
| 12 | Serialization & Templating | Insecure deserialization, gadget chains, SSTI, XXE |
| # | Module | Focus |
|---|---|---|
| 13 | HTTP Desync & Caching | Request smuggling (HTTP/1 and HTTP/2), CRLF injection, cache poisoning |
| 14 | Modern Web & API Attacks | JWT, OAuth/SAML/SSO, ViewState, CI/CD exposure |
| # | Module | Focus |
|---|---|---|
| 15 | Business Logic & Race Conditions | Logic flaws, TOCTOU, concurrency abuse |
| 16 | Cryptography & Configuration | Cryptographic flaws, security headers, misconfiguration, rate limiting |
| 17 | Secure Code Review | White-box methodology, source-to-sink tracing |
Thirty-four reproducible labs against the disposable target range, each self-contained — objective → prerequisites → environment setup → numbered walkthrough of complete HTTP requests → expected result → detection → remediation → cleanup → troubleshooting. Eight run against DVWA, two against OWASP Juice Shop, one against OWASP WebGoat, one against a PortSwigger Academy lab or a self-hosted equivalent, and twenty-two against purpose-built targets whose source is written out inside the lab itself. By level that is six Beginner, ten Intermediate and eighteen Advanced; by category the set spans A01, A02, A03, A04, A05, A07, A08 and A10 of the 2021 OWASP Top Ten.
| Lab | Module | Target | Level | OWASP |
|---|---|---|---|---|
| DVWA Brute Force | Authentication Testing | DVWA v1.10 | Beginner | A07:2021 |
| DVWA CSRF | Client-Side Attacks | DVWA v1.10 | Beginner | A01:2021 |
| DVWA Reflected XSS | Client-Side Attacks | DVWA v1.10 | Beginner | A03:2021 |
| DVWA Command Injection | Injection | DVWA v1.10 | Beginner | A03:2021 |
| DVWA SQL Injection | Injection | DVWA v1.10 | Beginner | A03:2021 |
| DVWA Weak Session IDs | Session Management | DVWA v1.10 | Beginner | A02:2021 |
| Juice Shop Broken Access Control | Access Control Testing | OWASP Juice Shop | Intermediate | A01:2021 |
| Mass Assignment Privilege Escalation | Access Control Testing | self-hosted Flask API | Intermediate | A01:2021 |
| Business Logic Negative Quantity | Business Logic & Race Conditions | self-hosted Node shop | Intermediate | A04:2021 |
| CORS Misconfiguration | Cryptography & Configuration | self-hosted PHP 8.2.33 API and attacker page, exploited from Chromium… | Intermediate | A05:2021 |
| DVWA File Inclusion | File Handling | DVWA v1.10 | Intermediate | A01:2021 |
| DVWA File Upload | File Handling | DVWA v1.10 | Intermediate | A04:2021 |
| SSTI Jinja2 to RCE | Serialization & Templating | self-hosted Flask 3.1.3 / Jinja2 3.1.6 on Python 3.12.14 | Intermediate | A03:2021 |
| XXE File Disclosure | Serialization & Templating | self-hosted PHP 8.2.33 endpoint | Intermediate | A05:2021 |
| Host Header Password Reset | Server-Side Attacks | self-hosted Flask app | Intermediate | A07:2021 |
| SSRF and Cloud Metadata | Server-Side Attacks | a local SSRF simulator you build, then your own cloud instance | Intermediate | A10:2021 |
| Race Condition Limit Overrun | Business Logic & Race Conditions | self-hosted Flask + SQLite shop | Advanced | A04:2021 |
| CSP Bypass with JSONP | Client-Side Attacks | self-hosted Flask pair | Advanced | A05:2021 |
| DOM XSS Sink Hunting | Client-Side Attacks | self-hosted "Acme Dashboard" SPA | Advanced | A03:2021 |
| Juice Shop XSS and CSP | Client-Side Attacks | OWASP Juice Shop | Advanced | A03:2021 |
| Prototype Pollution Server Side | Client-Side Attacks | self-hosted Node.js server | Advanced | A03:2021 |
| Prototype Pollution to XSS | Client-Side Attacks | self-hosted Node.js page | Advanced | A03:2021 |
| WebSocket Hijacking | Client-Side Attacks | self-hosted Python WebSocket server plus a static attacker origin | Advanced | A01:2021 |
| XS-Leaks Frame Counting | Client-Side Attacks | self-hosted Flask app plus a static attacker origin | Advanced | A01:2021 |
| Padding Oracle Decryption | Cryptography & Configuration | self-hosted Flask app | Advanced | A02:2021 |
| Cache Deception | HTTP Desync & Caching | self-hosted Flask origin + nginx:alpine reverse proxy |
Advanced | A05:2021 |
| Request Smuggling Detection | HTTP Desync & Caching | PortSwigger Academy lab or a self-hosted proxy/origin pair | Advanced | A05:2021 |
| LDAP Injection Auth Bypass | Injection | osixia/openldap:1.5.0 |
Advanced | A03:2021 |
| JWT Algorithm Confusion | Modern Web & API Attacks | self-hosted Flask token service | Advanced | A02:2021 |
| Open Redirect to OAuth Theft | Modern Web & API Attacks | self-hosted OAuth triad | Advanced | A01:2021 |
| Secure Code Review Walkthrough | Secure Code Review | self-hosted PHP report portal | Advanced | A01:2021 |
| Insecure Deserialization PHP | Serialization & Templating | self-hosted PHP 8.2.33 application | Advanced | A08:2021 |
| WebGoat Deserialization | Serialization & Templating | OWASP WebGoat | Advanced | A08:2021 |
| Blind SSRF with OOB | Server-Side Attacks | self-hosted Node containers on a private Docker network | Advanced | A10:2021 |
A reusable Lab Template carries the same skeleton for writing your own, and the target build instructions — DVWA, Juice Shop, and four PHP open-source business applications — remain under Vulnerable Web Application Lab Setup. Full index at Practical Labs.
Note
Where the output in a lab comes from
Every lab states its own provenance. DVWA was run in Docker on the authoring host and bound to 127.0.0.1:8081, because port 8080 was already occupied — check for the same conflict before you start. Where a target was not executed here, the lab labels its responses illustrative on the note itself and tells you to confirm them against your own instance. Note also that Burp Suite, sqlmap, ysoserial, semgrep and CodeQL are not installed on the authoring host; labs that reference them cite documentation rather than a captured run.
Fourteen capstone engagements that chain several modules into one time-boxed piece of work, each judged on a written deliverable rather than on whether a flag appeared. Every one states its target, scope and rules of engagement, objectives, deliverable format, and a self-assessment rubric — and every one is scoped against targets the course has already taught you to stand up. They run in the order below: mapping first, the technique-focused engagements next, then reporting, retest and detection.
| Capstone | Target | Level | Time |
|---|---|---|---|
| Recon and Attack Surface Mapping | DVWA and Juice Shop on loopback, plus a paper exercise against a real in-scope bug-bounty programme | Intermediate–Advanced | ~10–12 h |
| Full Web Application Assessment | DVWA, Juice Shop, or a PHP open-source application | Advanced | ~12–16 h |
| Injection Hunt Project | DVWA plus one PHP open-source application; a Node or Python service if you have one | Advanced | ~12–16 h |
| Access Control Matrix Project | DVWA plus one multi-role application (Juice Shop or a PHP open-source project) | Advanced | ~12–15 h |
| Authentication and Session Audit | DVWA plus one application with password reset and MFA | Intermediate–Advanced | ~8–10 h |
| Business Logic Assessment | OWASP Juice Shop plus one workflow application | Advanced | ~12–16 h |
| Client-Side Security Review | DVWA plus one JavaScript-heavy application | Advanced | ~10–12 h |
| Cryptographic Review Project | DVWA plus one token-issuing application, plus the padding-oracle and JWT lab targets | Advanced | ~10–14 h |
| Protocol-Level Assessment | A chain you assemble: nginx or HAProxy in front of a Python/Node origin, plus DVWA behind a proxy | Advanced | ~12–16 h |
| API and Web Combined Assessment | OWASP Juice Shop (Angular front end plus REST API) and one PHP open-source application | Advanced | ~12–14 h |
| Source Code Review Project | One reader-selected open-source PHP application | Advanced | ~14–18 h |
| Remediation Verification Project | The vulnerable and fixed variants of this course's lab targets | Advanced | ~10–12 h |
| Detection Engineering Project | The lab targets from this course, plus a log pipeline you assemble | Advanced | ~12–14 h |
| Web Pentest Report Writing | The findings you already hold | Intermediate | ~8–10 h |
Index at Mini Projects.
Seven spaced-repetition decks holding 336 cards in the Obsidian Question::Answer inline format, covering the exam-critical facts from every module — payload syntax, defence mechanisms, status codes, header semantics, and the OWASP identifiers.
| Deck | Cards |
|---|---|
| OWASP Top 10 | 56 |
| Server-Side and Protocol | 53 |
| Injection | 46 |
| Client-Side | 46 |
| Authentication and Sessions | 46 |
| Tooling and Methodology | 46 |
| Cryptography and Configuration | 43 |
Every factual claim on a card was checked against a primary source — an OWASP document, an IETF RFC, the MDN reference, vendor documentation, or output captured live on the authoring host — and cards about tools that are not installed here say so on the card itself. Index, format reference, and the plugin setting you must change before anything is scheduled: Flashcards.
| Domain | Outcome |
|---|---|
| Reconnaissance | Enumerate and map an application's full attack surface from a single domain |
| Tooling | Use Burp Suite and the ProjectDiscovery chain as a repeatable methodology |
| Injection | Identify and exploit every major injection class, including blind and out-of-band |
| Client-side | Exploit XSS, CSRF, and CORS flaws, and bypass client-side defences including CSP |
| Server-side | Exploit SSRF, Host-header trust, and file inclusion through to code execution |
| Identity | Break authentication, session handling, and access control end to end |
| Data formats | Exploit deserialization, XXE, and token-format flaws |
| Protocol | Demonstrate request smuggling and cache poisoning and explain the parser disagreement behind them |
| Logic | Find flaws that require understanding the business, not the payload |
| White-box | Review source code and trace untrusted input to a dangerous sink |
| Defence | State the detection signal and the correct remediation for every finding |
| Target | Alignment |
|---|---|
| PortSwigger Web Security Academy | Not a certification — a free, enumerable tree of 31 topics / 272 labs, and the de-facto syllabus for BSCP. Mapped topic by topic: 24 ✅ full · 5 🟡 partial · 2 ❌ gap. The two gaps are GraphQL and Web LLM attacks, both covered by sibling courses |
| eWPTX (INE) | The only one of the four that publishes a weighted objective blueprint. All 22 objectives mapped: 12 ✅ · 8 🟡 · 2 ❌. Strongest on Authentication, Injection and Server-Side — 40% of the exam combined; weakest on API Penetration Testing, which alone carries 25% and is covered by the sibling API course, not this one |
| Burp Suite Certified Practitioner (BSCP) | No published topic list exists, so the map follows the exam's three-stage structure. Stage 1 (reach any user account) and Stage 2 (reach the admin interface) are strongly covered; Stage 3 (read one file off disk) has two thin spots — stack-agnostic path traversal and SQL-based file read. Burp Suite Professional is mandatory for the exam and is not installed on the authoring host, so every Burp note here is documentation-derived |
| OSWE (OffSec WEB-300) | Partial. Mapped against the only public syllabus — a 2021 PDF listing 14 chapters, against the 17 modules the course page advertises. Across its 12 technical chapters: 6 fully covered · 4 partial · 2 carrying named gaps. Secure Code Review is the anchor; the single biggest gap is debugging a running application, which no note here teaches |
| CEH / GWAPT web domains | Not mapped. The vulnerability classes overlap broadly, but this folder contains no objective map for either vendor — do not treat this course as a syllabus for them |
Objective maps are maintained in Exam Preparation, which also records the date each vendor page was read.
Important
Three of these four publish no exam objectives Only eWPTX publishes a weighted objective list. The Academy publishes a topic tree, OffSec a course syllabus, and PortSwigger an exam format — each map states which substitute it used, and none of them calls a curriculum outline a blueprint. Figures the vendors do not publish — the BSCP pass mark, the eWPTX duration, the OSWE points and tool restrictions — are deliberately absent rather than estimated. Check them on the vendor's own site before booking.
- https://owasp.org/www-project-web-security-testing-guide/
- https://owasp.org/Top10/
- https://cheatsheetseries.owasp.org/
- https://portswigger.net/web-security
- https://portswigger.net/research
- https://docs.projectdiscovery.io/
Sibling courses in this vault that pair well with this one:
- Secure PHP Development — the defensive twin; every offensive note here has a "how to write it correctly" counterpart there.
- API Security & Advanced API Exploitation — protocol-level API testing, GraphQL and NoSQL depth.
- Certified Ethical Hacking & Penetration Testing — web-server enumeration, and the broader engagement lifecycle.
- Secure WordPress Administration — the same attacks against the most-attacked PHP CMS.
- Python for Security Professionals — building the custom tooling this course keeps reaching for.
See also the full curriculum catalog.
Contributions that improve accuracy, add labs, or deepen module notes are welcome.
| Guideline | Detail |
|---|---|
| Conventions | One H1 per note (matching the filename), an intro sentence, standard sections, language-tagged code fences |
| Links | This course-root Readme uses relative Markdown links ([text](Folder/Note.md)) so it renders on GitHub. Notes below this level use [[wikilinks]]. Keep link integrity when renaming or moving notes |
| Callouts | Use GitHub alert syntax — > [!NOTE], > [!TIP], > [!IMPORTANT], > [!WARNING], > [!CAUTION] |
| Vulnerable code | Always label intentionally insecure snippets // VULNERABLE and pair them with a secure version |
| Every finding, both sides | A vulnerability note is incomplete without a ## Detection and a ## Remediation section |
| Verified specifics only | No CVE number, version range, tool flag, or endpoint unless it is verified against a cited source. Describe the technique generically rather than assert an unverified detail |
| No placeholders | Do not link to files that do not yet exist; mark planned work as forthcoming |
| Scope | Keep each note single-topic and wire it into the relevant module Readme hub |
Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. Payload collections and exploitation walkthroughs are teaching material for authorized testing only. Third-party trademarks belong to their respective owners and are referenced for identification only. Run all labs in an isolated environment.