Back

Hacking Web Applications

Whether you’re a curious learner, aspiring ethical hacker, or someone who wants to secure their own website, this course provides an easy-to-follow and comprehensive pathway to mastering the basics of website hacking.

Tarek

Lead Trainer

5h 0m

Course Summary

Description
<p>Throughout this hands-on course, you’ll gain the knowledge and skills needed to identify vulnerabilities in websites and learn how hackers exploit them. With step-by-step guidance, real-world examples, and practical exercises, you’ll develop the skills necessary to protect websites and web applications from the most common online threats. By the end of this course, you'll feel confident in your ability to understand and prevent attacks, laying a solid foundation for a future career in cybersecurity. This course is focuses on practical skills you can immediately apply. You are expected to have basic knowledge and understanding of web technologies and concepts that are covered in the beginner level course.</p><h5><strong>Who is this course for?</strong></h5><ul><li><p>Penetration testers</p></li><li><p>Web developers</p></li><li><p>SOC analysts<br></p></li></ul>
Who is this course for ?
Modern Reconnaissance – Learn how modern recon works on multiple layers from the network to the application.
Common Website Vulnerabilities – Discover the top vulnerabilities that hackers target, SQLi, XSS, CSRF, SSTI and more.
Using Hacking Tools – Gain hands-on experience with popular tools like Burp Suite, WAS scanners, and others to find and exploit vulnerabilities.
Securing Websites – Learn the essential security measures to protect websites, such as input validation, encryption, secure session management, and proper error handling.
Best Practices for Website Security – Develop a solid understanding of web security best practices that every website developer should know and follow.
Coming soon

Course Curriculum

Reconnaissance, Enumeration, and Analysis

7 lessons

1. Reconnaissance (Passive & Active)

00:00

2. Subdomain Enumeration

00:00

3. Directory and File Brute-Forcing

00:00

4. Fuzzing Parameters

00:00

5. Technology Stack Identification

00:00

6. Business Logic Mapping

00:00

7. Lab: Recon + Enumeration

Cracking Identity

6 lessons

8. Identity & Authentication

00:00

9. Credential Attacks and Rate-Limiting Bypass

00:00

10. MFA and Other Authentication Mechanisms

00:00

11. Session Hijacking, Fixation, and Cookie Poisoning

00:00

12. Lab: Auth Attack Scenarios

13. Session Hijacking, Fixation, and Cookie Poisoning

00:00

Access Control & Authorization Failures

4 lessons

14. Access Control Fundamentals (Authentication vs Authorization)

00:00

15. Broken Access Control (BAC) Concepts and Patterns

00:00

16. Insecure Direct Object Reference (IDOR)

00:00

17. Lab: IDOR + Privilege Boundary Testing (horizontal + vertical access control checks)

Client-Side Attacks and Browser Trust

7 lessons

18. Client vs Server Execution

00:00

19. Cross-Site Scripting (XSS) Fundamentals

00:00

20. XSS Types (Reflected, Stored, DOM-Based)

00:00

21. HTML Injection and UI Deception

00:00

22. Cross-Site Request Forgery (CSRF)

00:00

23. Open Redirects and Trust Abuse

00:00

24. Lab: XSS + CSRF Testing in Burp (confirm execution + validate impact + apply defenses checks)

Exploiting the Back-End

4 lessons

25. SQL Injection

00:00

26. OS Command Injection

00:00

27. Server-Side Request Forgery (SSRF)

00:00

28. Lab: Backend Exploitation Chain (SQLi/Command Injection/SSRF based on app endpoints)

CMS Pentesting and Attacking

3 lessons

29. Content Management System Introduction

00:00

30. Attacking CMS

00:00

31. Lab: CMS Attack Walkthrough