◈OSA

Web Application Pentesting

Attack modern web apps: authentication flaws, every injection class, server- and client-side attacks, request smuggling and framework code review.

6 modules · 28 rooms · 241 tasks · Intermediate → Advanced

01 Authentications 5 rooms · 42 tasks
  1. Enumeration & Brute Force 7 tasks
  2. Session Management 8 tasks
  3. JWT Security 9 tasks
  4. OAuth Vulnerabilities 10 tasks
  5. Multi-Factor Authentication 8 tasks
02 Injections Attacks 6 rooms · 52 tasks
  1. Advanced SQL Injection 10 tasks
  2. NoSQL Injection 8 tasks
  3. XXE Injection 8 tasks
  4. Server-side Template Injection 10 tasks
  5. LDAP Injection 8 tasks
  6. ORM Injection 8 tasks
03 Advance Server-Side Attacks 5 rooms · 41 tasks
  1. Insecure Deserialisation 9 tasks
  2. SSRF 8 tasks
  3. File Inclusion, Path Traversal 8 tasks
  4. Race Conditions 7 tasks
  5. Prototype Pollution 9 tasks
04 Advance Client-Side Attacks 4 rooms · 37 tasks
  1. XSS 10 tasks
  2. CSRF 9 tasks
  3. DOM-Based Attacks 8 tasks
  4. CORS & SOP 10 tasks
05 HTTP Request Smuggling 3 rooms · 27 tasks
  1. HTTP Request Smuggling 8 tasks
  2. HTTP_2 Request Smuggling 9 tasks
  3. HTTP Browser Desync 10 tasks
06 Web Frameworks 5 rooms · 42 tasks
  1. Web Frameworks： Code Review 8 tasks
  2. Web Frameworks： Java 7 tasks
  3. Web Frameworks： Python 7 tasks
  4. Web Frameworks： .NET 7 tasks
  5. Source Code Review： PHP 13 tasks