Job role capstone: web security tester
As a web security tester you run a complete assessment from the scoping call to the retest, testing against the OWASP WSTG, keeping in daily contact with the client and delivering the technical report and executive summary.
Level 501 · 14 lessons · 12 practice labs
Lessons
Taking on the job
- Intake: the scoping call and proposal
- Authorisation letter, test accounts and environment preparation
- The method plan: a checklist following the OWASP WSTG
- Short task: send the client the kick-off e-mail and test plan
Test week
- Day 1: reconnaissance and mapping
- Day 2: identity, sessions and access
- Day 3: input-driven flaws
- Day 4: business logic and the API
- Daily status note and critical finding notification
- Short task: hand in the week’s interim report
Delivery
- Technical report and executive summary
- Debrief meeting with developers
- Retest after the fixes
- Capstone: run a complete web application assessment from kick-off to retest
Practice labs
- A proposal from scoping call notes: Prepare a proposal with scope, duration and assumptions from the notes of a scoping call with the client simulator.
- A test plan by WSTG: Derive a checklist prioritised by WSTG sections for the client app.
- Catch the missing authorisation letter: Find the missing hosts and dates in the authorisation letter and ask the client for a correction before testing starts.
- Test accounts and environment readiness: Verify test accounts for each role, request what is missing and report readiness to the client.
- A daily status note: Report the day's tests, findings and tomorrow's plan to the client in a short note.
- Attack surface from recon day: Map the client app's roles, endpoints and inputs and set testing priority.
- Report a critical finding at once: Report a critical flaw found during testing at once through the agreed channel with evidence and suggest an interim measure.
- The identity, session and access day: Find and prove the identity, session and access flaws in a client app with a randomised flaw set.
- Write the executive summary: Write a half-page executive summary of the week's findings for a non-technical reader.
- The closing meeting presentation: Prepare a short closing presentation that explains findings to developers with root cause and fix.
- Retest after the fixes: Retest the findings the client reports as fixed and report their status with evidence.
- A full assessment from start to finish: Run proposal, testing, report and retest in a short cycle on a new fictional client app.
About this course
As a web security tester you run a complete assessment from the scoping call to the retest, testing against the OWASP WSTG, keeping in daily contact with the client and delivering the technical report and executive summary.
What you will learn
- Taking on the job
- Test week
- Delivery
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.