Domain overview
This domain focuses on how web applications behave under stress, misuse and hostile input. It links attack surface discovery, manual testing and tool-assisted validation into a defensible application-security workflow.
Related certification context
These paths map closely to application-security work covered on this page.
- OffSec OSWA / WEB-200Foundational web assessment workflow and practical attack coverage.
- OffSec OSWE / WEB-300White-box web exploitation, source-guided review and custom exploit logic.
Curated public references
- OWASP WSTG · Latestowasp.org/www-project-web-security-testing-guide/latest/
- PortSwigger · portswigger.net/web-security
- OWASP Cheat Sheet Seriescheatsheetseries.owasp.org/
- OWASP ASVSowasp.org/www-project-application-security-verification-standard/
- OWASP API Securityowasp.org/www-project-api-security/
- PortSwigger · Documentationportswigger.net/burp/documentation
- GitHub · EnableSecurity / wafw00fgithub.com/EnableSecurity/wafw00f
Brief index
Introduction
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
OWASP Top 10 And Web Application Pentesting Theory
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Application Pentesting Practice
Manual web testing workflows, exploit validation, quick references and tool-assisted verification.
Browser Exploitation Framework (Beef)
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Burp Suite Professional
A practical interception and testing platform for manual web assessment, replay and exploit verification.
Web Application Firewall Bypass
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Vulnerability Assessment (Burp Enterprise)
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Vulnerability Assessment With Acunetix
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Vulnerability Assessment With Netsparker
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Vulnerability Assessment With Intruder.Io
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Web Vulnerability Assessment With Rapid7 Appspider
Endpoint abuse, authorization failures and protocol-level weaknesses in API-driven systems.
Quick Reference
Application-layer testing patterns for behaviour, trust boundaries and exploit validation.
Ewpt - Web Pentesting Certification
Public certification references relevant to the surrounding discipline.