Elif D.
Sample CVSS 4.0 finally makes sense
Scoring the lab findings and justifying each rating in a sentence was very practical.
Web application security testing with OWASP: find and fix risks
Test a deliberately vulnerable app with ZAP and Burp Community, cover the OWASP Top 10 with a clear method and write findings developers can fix
Created by Jonas Lindqvist
- Updated September 2026
- English
- Intermediate
What you will learn
- Set up a local practice lab with OWASP Juice Shop and scope your tools to it
- Use ZAP and Burp Suite Community Edition to inspect and modify web traffic
- Test access control, authentication and session handling methodically
- Recognise injection and cross site scripting risks and confirm them safely in a lab
- Run and tune automated scans without touching systems outside your scope
- Write findings with evidence, CVSS 4.0 severity and fixes developers can apply
Course content
Testing web apps safely and with a method
Mapping the application
- Video: Exploring like a user, recording like a tester 10 min
- Video: Reading requests and responses in the proxy history 11 min
- Article: Entry points and trust boundaries 9 min
- Article: Using the Web Security Testing Guide as a checklist 10 min
- Video: Passive scanning with ZAP 9 min
Access control, authentication and sessions
- Video: Testing horizontal access control 12 min
- Video: Testing vertical access control and admin functions 11 min
- Article: Authentication and password reset weaknesses 10 min
- Video: Sessions, cookies and JSON Web Tokens 11 min
- Video: Controlled manual tests with Burp Repeater 10 min
Injection and client side risks
- Video: SQL injection concepts in the lab 12 min
- Video: Cross site scripting: reflected, stored and DOM based 12 min
- Article: Security misconfiguration and response headers 9 min
- Article: Server side request forgery concepts 9 min
- Video: Error handling and unexpected input 9 min
Automated scanning with care
- Video: Running a ZAP active scan against your lab 12 min
- Article: Tuning scan policies and handling false positives 10 min
- Video: ZAP baseline scans in a CI pipeline 10 min
- Article: Finding outdated and vulnerable components 9 min
Reporting findings and fixes
- Video: Anatomy of a clear finding 10 min
- Article: Rating severity with CVSS 4.0 11 min
- Video: Recommending fixes developers can act on 10 min
- Article: Retesting, closing findings and the summary 9 min
- Quiz: Final check 6 min
Requirements
- Comfortable using a web browser's developer tools
- Basic understanding of HTTP, HTML and how web applications use APIs
- A computer that can run Docker
Description
Most web application breaches come from a short list of well understood mistakes. This course teaches you to find those mistakes the way professional application security testers do: with written permission, a clear method and a report that helps developers fix what you found.
How the course works
You will run OWASP Juice Shop, a deliberately vulnerable online shop built for training, on your own computer. Every exercise targets that local lab. You will map the application with an intercepting proxy, test it against the OWASP Top 10 categories using the OWASP Web Security Testing Guide as a checklist, and then write up each finding with evidence, a severity rating and a concrete fix.
- Setting up a safe local lab and scoping your tools to it
- Using ZAP and Burp Suite Community Edition for manual testing
- Testing access control, authentication, sessions and injection
- Running automated scans carefully and handling false positives
- Rating findings with CVSS 4.0 and writing actionable remediation advice
Legal and ethical boundaries
Testing systems you do not own or have written authorisation to test is illegal in most countries. Every technique in this course is practised only on your local lab or on training platforms that grant permission. The course explains what authorisation for real work looks like and how to keep your tools inside the agreed scope. The aim throughout is defensive: find weaknesses so they can be fixed, and help developers stop them from coming back.
Who this course is for
- Developers and QA engineers who want to test their own applications
- Junior security analysts moving into application security
- Students preparing for web application security certifications
Instructor
Jonas Lindqvist
Application security engineer helping developers write, review and test secure code
- 4.3 instructor rating
- 28 reviews
- 7,320 students
- 4 courses
- Sample
I sit between development and security teams, reviewing code, tuning scanners and teaching developers how common vulnerabilities actually appear in real code bases.
My courses are written for developers first. We read vulnerable code, exploit it in a safe lab, fix it and add a test or rule so it stays fixed. Examples use Python, JavaScript and Java because that is what most teams I meet write.
I focus on the OWASP Top 10, API security, authentication, and tooling such as Semgrep, CodeQL and secret scanners. My aim is that security becomes part of your normal review, not a separate step at the end.
Student reviews
Yusuf K.
Sample Reporting section is gold
Rewriting weak findings into strong ones was eye opening. Our developers now actually read the reports.
Marta S.
Sample A method instead of random clicking
I used to fire up a scanner and hope. The WSTG checklist approach and the finding template changed how I test our own apps at work.
Diego R.
Sample Good balance of ZAP and Burp
Nice that it works with free tools only. The Repeater lessons made manual testing feel much less chaotic.
Kwame A.
Sample Juice Shop lab was perfect
Running everything locally against Juice Shop meant I could practise without worrying about where my traffic was going.
Irina P.
Sample Strong on access control
The two account approach to horizontal access control was the most useful part. I would have liked one more example on APIs.
Tariq M.
Sample Clear about legal boundaries
Appreciated how often it repeats that you only test your own lab or with written permission. Good habit to build early.
Hannah W.
Sample Solid but assumes some HTTP
Content is accurate, but I had to pause and read up on JWTs and cookies before the session lessons made sense.
$64.99
Enroll now