OSAOffensive Security Academy
IntermediateAdvanced

Web Application Pentesting

Attack modern web applications through authentication flaws, injection vulnerabilities, client-side attacks, request smuggling and framework-level weaknesses.

6 modules 28 rooms 237 tasks 0 completed
Course progress 0% Not started
Course roadmap

6 modules, in order

Each module builds on the last. Rooms can be taken out of order — progress is tracked per task either way.

01 Authentications 5 rooms · 40 tasks 0%
  1. Enumeration & Brute Force 7 tasks
  2. Session Management 7 tasks
  3. JWT Security 8 tasks
  4. OAuth Vulnerabilities 10 tasks
  5. Multi-Factor Authentication 8 tasks
02 Injections Attacks 6 rooms · 52 tasks 0%
  1. Advanced SQL Injection 10 tasks
  2. NoSQL Injection 8 tasks
  3. XXE Injection 8 tasks
  4. Server-side Template Injection 10 tasks
  5. LDAP Injection 8 tasks
  6. ORM Injection 8 tasks
03 Advance Server-Side Attacks 5 rooms · 41 tasks 0%
  1. Insecure Deserialisation 9 tasks
  2. SSRF 8 tasks
  3. File Inclusion, Path Traversal 8 tasks
  4. Race Conditions 7 tasks
  5. Prototype Pollution 9 tasks
04 Advance Client-Side Attacks 4 rooms · 37 tasks 0%
  1. XSS 10 tasks
  2. CSRF 9 tasks
  3. DOM-Based Attacks 8 tasks
  4. CORS & SOP 10 tasks
05 HTTP Request Smuggling 3 rooms · 25 tasks 0%
  1. HTTP Request Smuggling 8 tasks
  2. HTTP_2 Request Smuggling 9 tasks
  3. HTTP Browser Desync 8 tasks
06 Web Frameworks 5 rooms · 42 tasks 0%
  1. Web Frameworks： Code Review 8 tasks
  2. Web Frameworks： Java 7 tasks
  3. Web Frameworks： Python 7 tasks
  4. Web Frameworks： .NET 7 tasks
  5. Source Code Review： PHP 13 tasks