Who it is for
- Junior and mid-level penetration testers who want an engagement-grade method, not a list of payloads.
- Bug bounty hunters who want to understand why a vulnerability exists and report it with impact.
- Developers and application security engineers who test their own company’s applications.
What you will be able to do
- Scope a web or API test with written authorisation, rules of engagement and a test plan.
- Map the attack surface from both the running application and its source code.
- Find and confirm authentication, access-control and multi-tenant flaws with a repeatable method.
- Exploit server-side and browser-side vulnerabilities in a lab, and choose safe proofs for live systems.
- Test business logic and race conditions that automated scanners cannot model.
- Write a report with impact, evidence and remediation, then verify the fix on a patched build.
Before you start
- You understand HTTP, cookies, headers and how web applications and APIs work.
- You have used Burp Suite or Caido and solved some web security labs, for example on PortSwigger Web Security Academy.
- You can read some code and work with Linux and Docker. We start with a short assessment of your level.
Syllabus
Eight modules in the order of a real engagement, adapted to your level.
Engagement foundationsAgree what you may test and how, before you send a request.
- Written authorisation and rules of engagement
- Scoping applications, APIs, environments, accounts and roles
- A test plan mapped to OWASP WSTG and ASVS
- Handling evidence and personal data safely
Reconnaissance and attack-surface mappingFind every way in, from the outside and from the code.
- Crawling compared with the routes the source code declares
- OpenAPI specifications, GraphQL schemas and JavaScript bundles
- A roles-by-endpoints matrix
- Choosing what to test first
Authentication and session testingTest how the application decides who you are.
- Login, MFA, password reset and session handling
- JWT, OAuth and OpenID Connect flaws
- Account takeover chains
- Confirming the cause in code
Access control and multi-tenancyProve whether one user can reach another user’s data or functions.
- The two-account method for BOLA, IDOR and BFLA
- Privilege escalation and tenant breakout
- Semi-automated authorization checks
- Reading the missing check in source
Server-side injection and request forgeryExploit the server, and know how far to go on a live system.
- SQL, command and template injection
- SSRF, path traversal, XXE and unsafe deserialization
- File uploads and parser abuse
- Safe proofs for production compared with full exploitation in the lab
Browser-side vulnerabilitiesTest what the application lets an attacker do in a victim’s browser.
- XSS by context, and what CSP does and does not stop
- CSRF, CORS and clickjacking
- postMessage and client-side routing
- Demonstrating impact responsibly
Business logic, races and API abuseBreak the rules of the product, not only its parser.
- Workflow and state abuse
- Race conditions in limits, balances and coupons
- Mass assignment, rate limits and webhooks
- The OWASP API Security Top 10 in practice
Impact, reporting and retestingTurn findings into decisions, then confirm the fixes.
- Chaining findings and stating real impact
- Severity with CVSS v4.0 and business context
- Reproducible evidence and an executive summary
- Remediation verification on a patched build
Practical work
Module labs
Labs against applications I prepared for the course, with source code available, so you can confirm every finding at its cause.
Two-account drills
Repeatable exercises in access-control and tenant-isolation testing, the area where real applications most often fail.
Report clinics
Short writing exercises that turn raw findings into report entries a developer and a manager can both act on.
Final assessment
A full engagement, from scope to retest
A time-boxed test of a multi-role SaaS application built for the course, with source access. You write the scope and test plan, test, report, and then retest a patched build. We go through your report together.
How it is assessed
- Scope and test plan that match the rules of engagement
- Coverage of authentication, access control and business logic
- Confirmed, reproducible findings with sound severity
- Safe, proportionate proofs
- A report a developer and a manager can both act on
- An accurate retest of the fixes
How this course is different
One student, one instructor
You test alongside me, and each session starts from what you found since the last one.
Black-box and white-box together
You test the running application and confirm each finding in its source code, which is how you tell a real vulnerability from a coincidence.
A whole engagement
Scoping, reporting and retesting are taught and assessed alongside exploitation, with recent CVEs I analysed as cases.
Tools you will use
Standards and references
- OWASP Web Security Testing Guide (WSTG)
- OWASP API Security Top 10
- OWASP Application Security Verification Standard (ASVS)
- NIST SP 800-115, Technical Guide to Information Security Testing
- FIRST CVSS v4.0
Case studies you can read now
- CVE-2026-104935: Ivanti trusts the header, not the URL
- CVE-2026-85097: Bricksforge trusts the file you name
- Security code review or penetration testing: what should you buy?
Questions about this course
Is this a beginner’s ethical hacking course?
No. It assumes you know the basics of web security. If you are starting from zero, free resources such as PortSwigger Web Security Academy are the right first step, and the initial assessment shows whether you are ready for this course.
How long does it take?
It depends on your starting level and the time you have between sessions. We agree a plan after the initial assessment and adjust it as you progress.
Do I need Burp Suite Professional?
No. The labs work with Burp Suite Community or Caido. Where a Professional feature saves time, I show a free alternative.
Does it cover networks or Active Directory?
No. The course is focused on web applications and APIs, where I do my own testing.
When can I start?
Send a short message about your level and goals. I reply within three days to arrange a free 20-minute assessment call, and we agree your plan and start date after it.
How much does it cost?
Each course costs $1,490 for about 10 one-to-one sessions of 90 minutes, with labs, exercise review, a final assessment and a certificate. Both courses together cost $2,690, and a single 90-minute session costs $150.
How does one-to-one training work?
We meet online for live sessions. Between sessions you work on labs and exercises I set for your level, and in the next session we go through your results. The pace follows your progress, not a fixed timetable.
Which language are the sessions in?
English for international students. Arabic speakers can choose Arabic or English; Arabic sessions keep the English terms you will see in tools, reports and job listings.
Is any of the training in person?
No. All sessions, labs, exercises and feedback are online.
Will I receive a certificate?
You receive a certificate of completion when you pass the final assessment. It is issued by me and is not an industry certification such as OSWE. What an employer can check is the work itself: your final report.
Are the hands-on exercises legal?
Yes. All practical work uses applications I prepared for the course and open-source projects at versions with published advisories, running on your own machine. You never test a system you do not own or have written permission to test.
What if I need more time?
If you need more sessions than planned, each extra session costs $150, and we agree it before it happens.
Next
Deepen the code side with the secure code review course.