Web application security testing with Python
Step by step you write tools that find input points in your own app, fuzz them in a controlled way and prove OWASP weaknesses.
Level 301 · 16 lessons · 15 practice labs
Lessons
Mapping the surface
- A small crawler that follows links
- Collecting forms and parameters automatically
- Pulling hidden endpoints out of JavaScript files
- Short task: list all of the application’s input points
Controlled fuzzing
- Fuzzer design: wordlists, encoding, response diffing
- A fast but polite fuzzer with asyncio
- Finding anomalies by length, time and status code
- Short task: catch unexpected behaviour in a search parameter
Proving weaknesses
- Confirming SQL injection with timing and boolean differences
- Testing reflected XSS with a harmless marker
- Confirming SSRF with your own listener
- A check that proves path traversal
- Short task: prove the weakness, then re-test after the fix
Reporting and wrap-up
- Saving requests and responses as evidence
- A finding report with severity, impact and fix
- Capstone: your own web security scanner for the lab app
Practice labs
- The application’s input points: Write a small crawler that stays in scope on the lab app, and list every form and parameter with its page URL.
- Endpoints hidden in JavaScript: Write a script that pulls API paths out of the lab app’s JavaScript files, and mark the endpoints the crawler did not find.
- A crawler that logs itself out: Fix a crawler that follows the logout link and loses its session, and loops on endless calendar pages, and show it covers all sections while staying logged in.
- Odd behaviour in a search box: Write a script that sends values from a small wordlist to the lab app’s search parameter and flags unexpected responses by length and status code.
- A fast but polite fuzzer: Add a concurrency limit and back-off to a fuzzer that overloads the lab app, and show response times stay healthy while findings stay the same.
- Anomalies on a page that changes every time: Add a comparison that strips changing fields to a fuzzer that raises false alarms because every response has a new timestamp and random token, and find the real anomaly.
- Confirm reflected input with a harmless marker: Write a check that sends a harmless unique marker to your own lab app and finds which parameter is reflected into the page unencoded.
- Confirm SQL injection by boolean difference: Within the authorised test, confirm the weakness in the lab app’s sort parameter by measuring the response difference between true and false conditions, and save the evidence file.
- Prove SSRF with your own listener: Prove the lab app’s link-preview feature makes server-side requests using a log hit on your own lab listener, then re-test after the fix and show it is closed.
- Store request-response evidence: Write an evidence module that saves the request and response for each finding to timestamped files with secrets masked.
- A path traversal re-test after the fix: Write a check that proves path traversal in the Oakmere Studios lab app’s file download endpoint, re-test with encoded variants after the developer’s patch, and report the outcome.
- A findings report from your own scanner: Combine the crawling, reflected-input and path traversal checks into one tool, run it on the lab app and report each finding with severity, impact and a fix.
- Audit the flags on the session cookie: Log in to your own lab app with a script, read the Secure, HttpOnly and SameSite settings on the returned cookies and report the missing ones by cookie name.
- Does the session really end after logout?: Write a check that tests on the lab app whether the old session token is still accepted after logout and whether the token is renewed at login, then run the same check again after the fix.
- An access-control table with two users: Within the authorised test, write a check that calls the lab app’s API endpoints as two separate test users and tabulates where one user can reach a record belonging to the other, report the finding with evidence and show the table comes out clean after the fix.
About this course
Step by step you write tools that find input points in your own app, fuzz them in a controlled way and prove OWASP weaknesses.
What you will learn
- Mapping the surface
- Controlled fuzzing
- Proving weaknesses
- Reporting and wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.