In modern web applications, server-side vulnerabilities represent some of the most prevalent and impactful attack surfaces for penetration testers. With the rise of complex web application architectures—layered systems, microservices, and APIs—server-side components are more exposed to risks than ever before. When exploited, these vulnerabilities can result in sensitive data exposure, unauthorized access, or full system compromise, making them critical targets for offensive security testing.
This course covers a comprehensive range of topics designed to enhance the skills of professional web application penetration testers. It begins with an overview of Modern Web Application Architecture, exploring the components, layers, and models like layered architecture, microservices, and serverless. The course then dives into key server-side vulnerabilities, like SSRF, covering basic and advanced exploitation techniques and attack chains. This course will also introduce you to the serialization and deserialization process, focusing on insecure vulnerabilities, what causes them, and how they can be exploited. Practical exploitation techniques are explored across language-specific deserialization, including PHP Object Injection, Java deserialization, and Python deserialization. This combination of foundational knowledge and hands-on techniques ensures testers are equipped to identify and exploit modern server-side attack surfaces effectively.
