Domain overview
Application work is about state, trust, identity and business actions. This domain stays focused on reproducible proof, useful remediation and the patterns that repeatedly produce serious findings.
Related certification context
These paths map closely to application-security work covered on this page.
- OffSec OSWA / WEB-200Foundational web assessment workflow and practical attack coverage.
- OffSec OSWE / WEB-300White-box web exploitation, source-guided review and custom exploit logic.
Selected public references
- OWASP WSTG · Latestowasp.org/www-project-web-security-testing-guide/latest/
- PortSwigger Web Security Academyportswigger.net/web-security
- OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/
- OWASP ASVSowasp.org/www-project-application-security-verification-standard/
- OWASP API Securityowasp.org/www-project-api-security/
- PortSwigger · Documentationportswigger.net/burp/documentation
- GitHub · EnableSecurity / wafw00fgithub.com/EnableSecurity/wafw00f
Topic index
Introduction
Introduction: web application security assessment context, validation priorities and evidence that supports a defensible finding.
OWASP Top 10 And Web Application Pentesting Theory
OWASP Top 10 And Web Application Pentesting Theory: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Application Pentesting Practice
Web Application Pentesting Practice: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Browser Exploitation Framework (BeEF)
Browser Exploitation Framework (BeEF): sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Burp Suite Professional
Burp Suite Professional: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Application Firewall Bypass
Web Application Firewall Bypass: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Vulnerability Assessment (Burp Enterprise)
Web Vulnerability Assessment (Burp Enterprise): sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Vulnerability Assessment With Acunetix
Web Vulnerability Assessment With Acunetix: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Vulnerability Assessment With Netsparker
Web Vulnerability Assessment With Netsparker: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Vulnerability Assessment With Intruder.io
Web Vulnerability Assessment With Intruder.io: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Web Vulnerability Assessment With Rapid7 AppSpider
Web Vulnerability Assessment With Rapid7 AppSpider: sessions, browser boundaries, server-side authorization and application logic under realistic request flows.
Quick Reference
Quick Reference: web application security assessment context, validation priorities and evidence that supports a defensible finding.
eWPT - Web Pentesting Certification
eWPT - Web Pentesting Certification: certification scope, expected competencies and a practical route from objectives to hands-on validation.