Web Application Security

OWASP Top 10 to Burp workflows.

How the web works, auth sessions, OWASP Top 10, API/JWT basics, Burp Suite workflows, and remediation-focused reporting — practiced only on authorized lab apps.

Level: Intermediate
Duration: 10 weeks
Modules: 3 modules · 22 lessons
Learning method: Lessons + labs

Preview first lesson

What you will learn

Map request/response and session flows
Explain and demo common OWASP issues in labs
Use Burp for manual validation
Write remediation-ready findings

Course curriculum

Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.

Module 1

How the web works

HTML/JS security basics, HTTP, cookies, sessions.

0/5 lessons

Lessons

1. How Websites Workpreview~22 min
2. HTML, CSS and JavaScript Security Fundamentals~22 min
3. HTTP Requests and Responses~22 min
4. Cookies and Sessions~22 min
5. Authentication Security~22 min

Module labs

Enrol to unlock full lessons and track module progress.

Module 2

OWASP Top 10 core

Injection, XSS, CSRF, SSRF, access control, uploads.

0/10 lessons

Lessons

1. OWASP Top 10~22 min
2. SQL Injection~22 min
3. Cross-Site Scripting (XSS)~22 min
4. Cross-Site Request Forgery (CSRF)~22 min
5. Server-Side Request Forgery (SSRF)~22 min
6. Broken Access Control~22 min
7. IDOR~22 min
8. File Upload Vulnerabilities~22 min
9. Directory Traversal~22 min
10. Security Misconfigurations~22 min

Module labs

Enrol to unlock full lessons and track module progress.

Module 3

APIs, Burp & remediation

API/JWT/OAuth, Burp workflows, secure coding.

0/7 lessons

Lessons

1. API Security~22 min
2. JWT Security~22 min
3. OAuth Security Fundamentals~22 min
4. Business Logic Vulnerabilities~22 min
5. Burp Suite Professional Workflows~22 min
6. Web Application Penetration Testing~22 min
7. Secure Coding and Remediation~22 min

Module labs

Enrol to unlock full lessons and track module progress.

OSINT in this course

Open-source intelligence is taught here — not only under Resources. Use authorized, public sources; no doxing or harassment; document sources and timestamps.

Digital footprint analysis — Reduce your org’s public attack surface using the same sources adversaries use.

Full OSINT center → · Investigation playbook

Inside this course

Labs · Quizzes · Certificate

Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.

Course labs

24 assigned labs · free with this course enrol

Security Header PickUnlock via course or plan
HttpOnly CookieUnlock via course or plan
Reflect the Payload (Safe Sim)Unlock via course or plan
Break the Query (Simulated)Unlock via course or plan
CSRF Token CheckUnlock via course or plan
Spot the IDORUnlock via course or plan
SSRF Target SpotUnlock via course or plan
JWT Segment CountUnlock via course or plan

+16 more assigned

Track quiz

107 questions matched to this course topics

Knowledge checks for this track only — not a separate global quiz menu.

Start track quiz

CYNARKS certificate

Educational completion certificate · verify by ID

Your progress: 0% · enrol to unlock claim

Enrol in this course first.