OWASP Course 2025 | Complete Guide | Beginner Friendly

Explore real-world authentication vulnerabilities by performing brute-force login attacks on a deliberately vulnerable blog site, using Burp Suite to enumerate usernames and passwords and gain admin access.

Explore vulnerable authentication logic through hands-on labs, demonstrating brute force testing with username and password lists, payload variations, and HTTP responses to reveal login weaknesses.

Learn to test authentication vulnerabilities by performing brute-force attacks against a vulnerable site using Burp Suite, identifying valid usernames and passwords, bypassing lockout with x-forwarded-for, and accessing the account page.

Explore directory traversal vulnerabilities through hands-on labs that show how changing image paths and root directory access can reveal server files using Burp Suite, Intercept, Repeater, and HTTP history.

Explore path traversal vulnerabilities by examining how image requests reveal server directories and files, learn how root directory access and directory traversal patterns expose confidential content in hands-on labs.

Explore how to identify image-based vulnerabilities on a vulnerable shopping site using proxy tools, intercepts, and response analysis, including directory traversal attempts with dot dot slash and root directory checks.

Explore testing vulnerable urls for directory traversal in the OWASP course context using burp suite, image parameters, and url encoding and decoding to reveal access results.

Learn how advanced directory traversal works in an e-commerce site, using Burp Suite to manipulate image parameters and access root directories to reveal sensitive files.

Explore directory traversal vulnerabilities and null byte bypass techniques in this beginner-friendly OWASP course, using Burp Suite tools to test image file requests, URL encoding, and root directory access.

Identify and exploit OS command injection vulnerabilities in a vulnerable shopping site using Burp Suite to intercept, manipulate parameters, and test reflected results with Linux and Windows commands.

Demonstrate OS command injection by manipulating product ID and store ID parameters, using intercept and repeater to send requests, and running commands like who am I to reveal system details.

Identify OS command vulnerabilities by exploring parameters on a vulnerable shopping site, manipulate inputs, observe responses, and verify injection using Burp Suite and Repeater.

Explore common vulnerabilities in a shopping site, including os command vulnerabilities and directory traversal, by manipulating inputs, intercepting requests, and reading server files.

Solve vulnerabilities labs by identifying parameters on a vulnerable shopping site and using intercept and repeater for out-of-band inspection. Apply commands like whoami and nslookup to reveal DNS details.

Explore application logic vulnerabilities in a shopping website, learn how login, credits, and cart actions interact, and demonstrate price manipulation by intercepting and modifying requests via a proxy.

Explore lab 2 on two-factor authentication vulnerabilities by bypassing a blog site's two-factor flow using default credentials, intercepting requests, and brute-forcing a four-digit code to access user accounts.

Explore security testing in action as you analyze brute-force login attempts, four-digit security codes, intruder payloads, and http status responses using intercept tools to assess target accounts.

Demonstrates identifying and exploiting application logic vulnerabilities in an e-commerce lab, using burp intercepts to manipulate product IDs and prices to bypass checks and complete unauthorized purchases.

Discover access control vulnerabilities on websites by scanning a target site with Kali Linux and GoBuster, enumerate pages, and inspect robots.txt and login/logout flows.

Explore access control vulnerabilities by scanning a target site with Go-buster and RB commands, inspecting the source code and pages to reveal unprotected login areas.

Explore access control vulnerabilities through a lab that enumerates a target site, finds an admin panel, and tests administrator login to reveal privilege escalation risks.

Explore how to identify and exploit access control vulnerabilities to access admin panels, view and modify user details, and escalate privileges within a target web app.

Identify and exploit access control vulnerabilities to reach admin panels and delete users, using Barb tool to intercept requests and test login flows.

This lab demonstrates exploiting access control vulnerabilities to obtain another user's API key by intercepting and modifying requests with Burp Suite, using intercept, repeater, and ID manipulation.

Explore solving access control vulnerabilities in lab 8 of blog site, login to view your account, and intercept requests to see how changing user IDs reveal other users' api keys.

Learn how error messages disclose server details to reveal vulnerabilities by intercepting requests with Burp Suite, manipulating product id parameters, and triggering 500 errors to infer Apache 2.3.31.

Use barbecue tools to intercept and inspect a target site, locate php info and a secret key. Review the php version, server details, and MySQL data.

Solve information disclosure labs by exploring a shopping site with Burp Suite, inspecting requests, and uncovering hidden backup pages, robots.txt, and default files to reveal exposed data.

Investigate information disclosure by accessing a site's admin interface via a local IP, using Burpsuite to manipulate requests and delete an admin user.

Learn to scan target sites with Kali Linux, use Go-buster for directory enumeration, identify admin pages, and test login access via HTTP status codes.

Learn how upload vulnerabilities enable web shell uploads on a blog site, demonstrate intercepting requests with Burp Suite, and reveal how a PHP shell can access server files.

Demonstrates locating image upload points on a blog site, bypassing file type restrictions to upload a php payload, and using it to reveal secret text via a vulnerable endpoint.

Explore uploading vulnerabilities on a blog site by using path traversal to upload a php web shell and bypass restrictions, testing with Burp Suite and Repeater for 200 responses.

Learn extension bypass methods to exploit upload vulnerabilities, including image uploads, trying php variants, and configuration-based vectors on an apache server, as part of the OWASP course.

Identify upload vulnerabilities on a target site by testing allowed jpeg and png uploads, bypassing filters with null bytes, and deploying a php payload to access or view restricted content.

Examine advanced file upload vulnerabilities and metadata manipulation to bypass restrictions, demonstrating how malicious PHP payloads can be embedded in image files and discovered via Exif tool.

Identify SQL injection vulnerabilities on a shopping site by manipulating product and category parameters and encoding inputs. Use Burp Suite to intercept requests and test true/false conditions for database access.

Identify and exploit SQL injection vulnerabilities on target websites using Burp Suite tools like Intercept and Repeater, test errors, URL encoding, and union select to reveal usernames and passwords.

Explore SQL injection vulnerabilities and practice testing them with proxy tools, encoding techniques, and union-based payloads to identify reflected data such as usernames and passwords.

Learn sql injection testing to identify vulnerabilities, determine the database type, enumerate tables and columns with information schema, and extract usernames and passwords to log in as administrator.

Identify sql injection vulnerabilities on a target site, test input parameters, and understand how database structures and credentials may be exposed in a controlled setting.

Explore solving SQL injection labs, identifying vulnerable parameters, understanding blind SQL injection, and ethically discovering user accounts and passwords in a controlled testing environment.

Explore SQL injection vulnerabilities using Burp Suite on an Oracle database, identify weaknesses, and uncover an administrator password through controlled payloads in a lab setting.

Test sql injection vulnerabilities on a target site with BurpSuite, intercept and replay requests, and use time-delay payloads to identify databases such as PostgreSQL or MySQL and enumerate users.

Learn to identify SSRF vulnerabilities on a shopping site using Barb proxy tools to intercept, forward, and replay requests, access the admin panel, and delete users.

Explore blacklist-based input filtering and parameter tampering to uncover vulnerabilities in a shopping site, part of the owasp course, using burp suite tools, intruder brute-force attacks, and admin privilege testing.

Explore SSRF filter bypass techniques using Burp Suite to test server requests, decode URL encodings, and explore localhost access and an admin panel at /admin.

Explore blind ssrf vulnerabilities using Burp Suite to test server-side requests on a shopping site, manipulate localhost and IP addresses, access the admin panel, and delete a user.

Learn to use burp tools to intercept and modify requests on a shopping site, test vulnerabilities, and access the admin interface for demonstrations.