00
About this phase
Web testing is where automation and manual skill meet. An intercepting proxy like Burp Suite or OWASP ZAP sits between browser and server, letting you read and rewrite every request — the core technique behind exploiting most web flaws. Scanners find the obvious; manual testing in the proxy finds the rest. Practice targets like DVWA provide a legal place to drill file upload, local file inclusion, and remote code execution.
This phase is the offensive frame around the site's deepest existing content: the full Web Application Security suite and the 18-technique SQL Injection track. The new material here is the tooling that drives them in an engagement.
Lessons
6 live
Phase
06 of 08
Status
Complete
01
Lessons & labs in this phase
06.01Live →
06.02Live →
06.03Live →
06.04Live →
06.05Live →
06.06Labs →
Web App Architecture for Testers
How requests, sessions, and back ends fit together — the mental model that makes attacks make sense.
Intercepting Proxies: Burp Suite
Proxy, Repeater, Intruder, Comparer, and Decoder — the tester's primary web instrument.
OWASP ZAP & Automated Scanning
The open-source alternative, automated discovery, and where scanners help vs mislead.
Web Fuzzing: ZAP to ffuf
From ZAP's fuzzer to the modern standard ffuf — matchers, filters, recursion, and a live command builder.
DVWA: File Upload, LFI & RCE
Chaining a malicious upload and file inclusion into remote code execution on a safe practice target.
Web & SQLi Lab Suites
XSS, CSRF, SSRF, IDOR, SSTI, and the full SQL-injection track. Live labs in Web App Security and SQL Injection.