A complete, free curriculum for the skills an entry-level web-pentest certification assesses: recon, access control, injection, server-side attacks, and the engagement. Built on OWASP WSTG; unaffiliated with any exam vendor.
This is a complete, free curriculum for becoming an entry-level web-application penetration tester. It teaches the same skills the industry's junior web-pentest certifications assess, built on the public OWASP Web Security Testing Guide, in this platform's own words and against this Academy's own labs.
It is not affiliated with, or endorsed by, any certification vendor, and uses none of their material. Where a lesson names an exam, it does so only to say "this covers the skills that exam tests".
Do the five paths in order. Each builds on the last, and each ends most of its lessons with a real lab so you practise the skill, not just read about it. Start with Web Security Foundations (the on-ramp, listed separately above) if a request and a response are still new to you; then work down:
By the end you will be able to walk up to an unfamiliar web target, map it, find and prove real findings across the major bug classes, and write them up the way a client or a program expects.
Before a single payload: find the hosts, name the technology, read what the site hands out for free, and map the attack surface. Where every real engagement, and every exam, actually starts.
PentestingHere · 0/7 done
The bug class that pays the most: is this person actually allowed to do this? IDOR, function-level access, weak logins, broken resets, hijackable sessions, and forgeable tokens, each with a real lab.
PentestingHere · 0/8 done
When your input stops being data and becomes code the server runs: SQL injection (UNION, blind, past filters) to read the database, and cross-site scripting (reflected, stored, DOM) to run your script in a victim's browser. Each with a real lab.
PentestingHere · 0/8 done
The highest-impact shelf: make the server read a file, run a command, fetch an internal URL, or parse hostile data. Path traversal, upload-to-RCE, command injection, SSRF, XXE, template injection and deserialization, each with a real lab.
PentestingHere · 0/8 done
Turn the techniques into professional work: a repeatable methodology (OWASP WSTG), notes and evidence, scope and the honesty gate, a report that survives triage, and how to approach a timed practical exam. No labs. The skill is judgement.
PentestingHere · 0/5 done