By completing this course, learners will be able to:

• Perform foundational black-box web application assessments.
• Conduct web application reconnaissance and content discovery.
• Use Kali Linux tools for web security testing.
• Identify and exploit reflected, stored, and client-side XSS vulnerabilities.
• Assess CSRF and CORS security weaknesses.
• Enumerate common database technologies and test for SQL Injection.
• Identify and exploit Directory Traversal vulnerabilities.
• Assess XML External Entity (XXE) vulnerabilities.
• Identify and exploit Server-Side Template Injection (SSTI).
• Test applications for SSRF, Command Injection, and IDOR.
• Combine multiple techniques during complete web application assessments.
• Prepare for the practical OffSec Web Assessor (OSWA) certification.

Module 1: Tools for the Web Assessor

• Web application assessment methodology
• Kali Linux tools for web testing
• Burp Suite
• Nmap
• Gobuster
• Wfuzz
• Hakrawler
• Web application enumeration
• File, directory, and parameter discovery
• Wordlist generation and usage
• Shells and payload fundamentals

Module 2: Cross-Site Scripting (XSS) – Introduction and Discovery

• JavaScript fundamentals for offensive security
• Reflected XSS
• Stored XSS
• Client-side XSS
• Discovering XSS vulnerabilities
• Understanding how XSS affects users and applications

Module 3: Cross-Site Scripting (XSS) – Exploitation and Case Study

• XSS exploitation techniques
• Moving payloads to external resources
• Session cookie theft
• Local secret extraction
• Keylogging
• Saved password theft
• Phishing scenarios
• Practical XSS case study

Module 4: Cross-Origin Attacks

• Same-Origin Policy
• SameSite cookies
• Cross-Site Request Forgery (CSRF)
• Detecting and exploiting CSRF
• Cross-Origin Resource Sharing (CORS)
• CORS request and response headers
• Identifying weak CORS policies
• Exploiting insecure origin trust
• Cross-origin attack case studies

Module 5: Introduction to SQL

• SQL fundamentals
• Basic SQL syntax
• Manual database enumeration
• MySQL database enumeration
• Microsoft SQL Server enumeration
• PostgreSQL enumeration
• Oracle database enumeration
• Database-specific functions and tables

Module 6: SQL Injection

• Understanding SQL Injection
• Testing parameters for SQLi
• String delimiters and query manipulation
• Boundary testing
• Fuzzing
• Error-based SQL Injection
• UNION-based SQL Injection
• Stacked queries
• Reading and writing files
• Remote Code Execution through SQL Injection
• SQLMap
• SQL Injection case studies

Module 7: Directory Traversal Attacks

• Directory Traversal concepts
• Relative and absolute paths
• Identifying suggestive parameters
• Directory listing
• File discovery
• Exploiting path traversal vulnerabilities
• Practical Directory Traversal scenarios

Module 8: XML External Entities (XXE)

• XML processing fundamentals
• XXE vulnerability discovery
• Local file disclosure
• External entity processing
• XXE-based SSRF
• Exploiting insecure XML parsers
• XXE case studies

Module 9: Server-Side Template Injection (SSTI)

• Template engines and server-side rendering
• SSTI vulnerability discovery
• Identifying vulnerable template syntax
• Exploiting template engines
• Template-specific payloads
• Escalating SSTI vulnerabilities toward code execution

Module 10: Command Injection

• Operating system command injection
• Identifying command injection points
• In-band command execution
• Blind command injection
• Payload construction
• Exploiting command execution vulnerabilities

Module 11: Server-Side Request Forgery (SSRF)

• SSRF fundamentals
• Interacting with vulnerable servers
• Accessing private IP ranges
• Internal service discovery
• SSRF testing methodology
• Retrieving information through SSRF
• Cloud instance metadata
• Authentication bypass scenarios
• Alternative URL schemes
• SSRF case studies

Module 12: Insecure Direct Object Referencing (IDOR)

• Understanding IDOR
• Static file IDOR
• Database object referencing
• ID-based IDOR
• Enumerating object references
• Exploiting complex IDOR scenarios
• IDOR case studies

Module 13: Assembling the Pieces – Web Application Assessment Breakdown

• Introduction to challenge machines
• Web application enumeration
• Host enumeration
• Operating system detection
• Content discovery
• Authentication bypass
• Finding and exploiting Directory Traversal
• Discovering SQL Injection
• Using SQL Injection for Remote Code Execution
• Obtaining a shell
• Combining multiple vulnerabilities during a complete assessment

5 Days

WEB-200 has a strong hands-on component. Learners can practice the techniques covered in the course against controlled lab environments.

Practical activities include:

• Web application reconnaissance and enumeration.
• Content and parameter discovery.
• Burp Suite-based request manipulation.
• XSS discovery and exploitation.
• CSRF and CORS testing.
• Database enumeration.
• Manual and automated SQL Injection testing.
• Directory Traversal exploitation.
• XXE exploitation.
• SSTI discovery and exploitation.
• Command Injection testing.
• SSRF exploitation.
• IDOR discovery and exploitation.
• Complete web application assessment scenarios.
• Nine challenge labs to help learners test their knowledge before attempting the OSWA exam.

Certification: OffSec Web Assessor (OSWA)

WEB-200 is suitable for:

• Web Application Penetration Testers
• Junior Penetration Testers
• Application Security Analysts
• Cybersecurity Professionals
• Security Engineers
• Web Application Developers moving into security
• Vulnerability Assessment Professionals
• Penetration Testers who want to specialize in web applications

• HTML, CSS, and JavaScript.
• Basic networking concepts.
• Linux operating system fundamentals.
• Basic scripting knowledge.
• Web application fundamentals.