Web Application Penetration Testing Complete Course 2023

Explore SQL injection testing on a shopping site by manipulating product and category parameters, using quotes and URL encoding (via burp suite) to reveal vulnerabilities and data exposure.

Solve sql injection vulnerabilities with Burp Suite, using intercept and repeater, enumerate ids via union select, extract usernames and passwords from the users table, and test logins.

Practice sql injection testing with proxy and repeater to identify vulnerabilities, enumerate columns via union select, and determine reflecting columns; extract usernames and passwords from users and attempt administrator login.

Identify sql injection vulnerabilities on the target site, determine the database type (oracle, microsoft, postgresql, mysql), and extract usernames and passwords from information_schema to log in as administrator.

Explore sql injection testing with Burp Suite to identify vulnerabilities, enumerate Oracle database tables and columns, and extract usernames and passwords.

Lab 7 teaches exploiting sql injection vulnerabilities in an Oracle database using Burp Suite, repeater, and intruder to enumerate users and extract the admin password with substr-based payloads.

Lab 8 demonstrates testing for sql injection vulnerabilities on a target site using Burp Suite, repeater, and time delay techniques to identify databases and extract data from the users table.

Test reflected xss vulnerabilities by injecting scripts into post id, comments, and search parameters, then verify reflections via view page source and observe the hacked by alert.

Explore stored XSS vulnerabilities on a blogging site by injecting malicious scripts into comments, observe outputs seen by other users, and practice intercepting requests with a proxy tool.

Explore dom-based xss by testing input reflection on a target site, inject malicious scripts, and verify alerts through view page source and payload variations.

Identify reflected input vulnerabilities on a shopping site by testing product and store parameters, injecting a malicious script, and validating access flaws with Burp Suite tools.

Complete lab 02 by testing a target website for available access vulnerabilities. Use search parameters and reflected input to trigger alerts with malicious script payloads via view page source.

Identify and exploit available access vulnerabilities on a blogging site by testing input parameters, posting comments, and injecting malicious JavaScript using Burp Suite and repeater.

Practice testing for access vulnerabilities on a target website with burp suite, intercept, and repeater. Inspect reflected inputs and experiment with script injections and alert payloads to gauge vulnerability.

Explore real-world web app penetration testing by identifying reflection vulnerabilities and testing input parameters for script injections, observing page source behavior, and evaluating how the app handles script inputs.

Explore how upload vulnerabilities enable web shells on a blog site and how Burp Suite is used to intercept and test remote code execution.

Explains bypassing content-type restrictions to upload a malicious PHP payload via an image upload feature, then executes and reads server files to reveal sensitive information.

Identify upload points on a blog site, test for upload vulnerabilities, and explore path traversal to access uploaded content using Burp Suite.

Learn to locate upload options, test uploading web shells and php-related extensions through extension bypass and directory configuration, and verify outcomes in a ctf-style vulnerability workflow.

Identify and exploit upload vulnerabilities to bypass file type checks and upload malicious code, using php payloads and null byte tricks to access and view uploaded content.

Explore advanced web application vulnerabilities by testing upload mechanisms, bypassing restrictions with login and default credentials, and using metadata tools to embed and verify hidden PHP code.

Explore vulnerable authentication logic through hands-on labs in web application penetration testing. Demonstrate brute-force, proxy interception, and intruder payload techniques using username and password lists to uncover login weaknesses.

Perform a hands-on lab on broken authentication, using burp suite intruder and repeater to brute-force credentials, and x-forwarded-for bypass techniques to access the administrator account.

Explore directory traversal vulnerabilities through hands-on labs, learning to identify file paths, manipulate image requests, and use Burp Suite to inspect and replay traffic to reveal root directory files.

Demonstrate directory traversal by altering image paths with dot-dot-slash to access root and password directories, using proxy intercept and repeater to verify 200 responses.

Learn practical web app penetration techniques by intercepting and analyzing image requests with a proxy, rendering responses, and testing directory traversal with dot dot slash to locate sensitive files.

Identify directory traversal flaws by manipulating image parameters in vulnerable urls with burpsuite, repeater, and http history, then test file access using encoded url parameters.

Demonstrates exploiting directory traversal on an e-commerce site with Burp Suite, using dot-dot-slash payloads to access restricted directories and image parameters.

Explore directory traversal and null-byte bypass against a shopping site. Use intercept, repeater, dot-dot-slash, URL encoding, and decoding to reach the root directory and read the /bin/bash file for flags.

Identify and exploit OS command injection vulnerabilities on a vulnerable shopping site using Burp Suite, proxy intercept, and reflected parameters across Linux and Windows commands.

Practice web application penetration testing by intercepting and replaying requests, manipulating product and store parameters to reveal stock results, and validating os command injection risks on linux.

Explore OS command vulnerabilities by identifying input parameters and testing command injection on a shopping site, using Burp Suite, intercept, and repeater to observe server responses and cookies.

Explore os command vulnerabilities and directory traversal on a shopping site. Use Burp Suite to intercept, modify parameters like product id and image, and test file creation and directory access.

Explore how to locate parameters on vulnerable shopping sites and apply intercept and repeater techniques to perform out-of-band inspection, revealing server details with commands like whoami and nslookup.

Investigate application logic vulnerabilities on a shopping website, examining login, cart, pricing, and credits, and learn how proxy-based testing can reveal price manipulation risks affecting orders.

This lab demonstrates exploiting two-factor authentication vulnerabilities on a blog site by using default credentials, intercepting login requests, and brute-forcing four-digit security codes with intruder to access any user account.

This lab demonstrates a brute-force login bypass against a target user, using default credentials and a four-digit security code with an intruder payload to test authentication resilience.

Explore application logic vulnerabilities in an e-commerce lab, including login bypass with default credentials, price manipulation, and cart edits using burp tool to test security.

Explore access control vulnerabilities by scanning a target shopping site with Kali Linux and go-buster, identifying pages, login redirects, and potential admin access.

Identify access control vulnerabilities by scanning a target site, inspecting its source code, and revealing an admin panel with two accounts and unprotected login.

Discover access control vulnerabilities on a target site, enumerate pages to locate an admin panel, and assess authentication risks through lab-based testing.

Identify access control vulnerabilities in a lab, log in with default credentials, and access the admin panel to observe how modifying email, username, and rule id can alter user data.

Illustrate access control vulnerabilities that enable retrieving a target's API key using burpsuite, proxy, and repeater. The lab demonstrates intercepting requests and altering IDs to access the API key.

Explore labs that demonstrate exploiting access control vulnerabilities to steal another user's API key by manipulating user IDs and requests, including intercepting, forwarding, and replaying requests.