Course Overview
Welcome to this course on Practical Web Hacking. This course follows on from the Practical Bug Bounty course and will take you deeper into the world of finding and exploiting vulnerabilities in web applications. It’s recommended that you have completed the Practical Bug Bounty course or at least one year's worth of experience in hacking web applications before you take this course. In this course, you will develop a deeper understanding of how web attacks work, learn to craft custom payloads and build a methodology for finding and exploiting more complex vulnerabilities.
Requirements:
- Completion of the Practical Bug Bounty course OR 1 years web hacking experience
-
A positive attitude
Course objectives:
- Understand how web applications and their various components work
- Understand common and intermediate attacks against web applications
- Ability to identify potential weaknesses and vulnerabilities in web applications
- Ability to craft payloads to exploit an identified vulnerability
Target audience:
Practical Web Hacking is aimed at those who want to understand, find and exploit vulnerabilities within web applications for penetration testing and bug bounty hunting. This is an intermediate course so an understanding of web applications and basic attacks is required. If you’re new to web application security testing then we recommend you take the Practical Bug Bounty course first. This course is also ideal for experienced network penetration testers who want to improve their web application testing skills.
System requirements:
- A computer able to run a Linux virtual machine
The course will cover:
- How web applications work
- Authentication attacks
- Broken access control
- Server-side request forgery
- Advanced SQL injection attacks and NoSQL injection
- File inclusion
- XML External Entity Injection
- XSS and filter bypasses
- Attacking JSON Web Tokens
- Mass assignment
- Open redirects
- Race conditions
- Capstone challenge
By the end of the course you will have a good understanding of how these attacks work, be able to find them in situations that are not immediately obvious or overlooked by automated scans and fuzzing. Be able to modify and craft custom payloads to bypass filters or achieve exploitation in unusual circumstances.
Course Curriculum - 10+ Hours
This course is included in our All-Access Membership starting at $29.99/month
Get full access to the Practical Ethical Hacking course and our full course catalog when you enroll in our All-Access Pass Membership.
About the Instructor
Alex is a Web Application Security specialist with experience working across multiple sectors, from single-developer applications all the way up to enterprise web apps with tens of millions of users. He enjoys building applications almost as much as breaking them and has spent many years supporting the shift-left movement by teaching developers, infrastructure engineers, architects, and anyone who would listen about cybersecurity.
Alex holds a Master's Degree in Computing, as well as CEH and OSCP certifications.
Follow Alex on Social Media:
Courses Included in the All-Access Membership
Frequently Asked Questions
Can I get a refund if I'm unhappy with my purchase?
Yes. All purchases come with a 3-day money-back guarantee.
Will I receive a certificate of completion when I finish a course?
Yes. All courses come with a certificate of completion.
Do the courses count as Continuing Education Units (CEUs)?
Yes. Every certificate of completion comes with the total CEUs earned listed on the certificate.
What is the All-Access Pass?
As of July 1st, 2023 TCM Academy transitioned to a monthly subscription model, where you now receive full access to all of the courses on our platform for as long as your subscription remains active.
What if you already own courses on TCM Academy?
If you already own a course on our platform, you will continue to own that course forever. Previously owned courses will not be affected by this change.