Web Application Penetration Testing Courses and Certifications

Bugcrowd

XML External Entity Injection

Learn to identify, exploit, and mitigate XML External Entity (XXE) vulnerabilities. Gain practical skills to enhance application security and protect against data disclosure and system impacts.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Cyber Mentor

Web App Testing - XXE, Input Validation, Broken Access Control, and More XSS

Explore advanced web app testing techniques including XXE, input validation, broken access control, and XSS. Enhance your ethical hacking skills and learn to identify critical vulnerabilities.

• YouTube
• 1 hour 57 minutes
• Self-Paced
• Free Video

Web Application Penetration Testing Basics

Learn practical web app penetration testing using Nmap, mitmproxy, ffuf, and curl—covering reconnaissance, API fuzzing, traffic interception, and vulnerability chaining on a real target.

• CodeSignal
• 3 hours
• Self-Paced
• Free Certificate

Cyber Mentor

Learn to Hack Live - Command Injection

Explore command injection vulnerabilities in web applications through live hacking demonstrations and hands-on exercises. Enhance your penetration testing and application security skills.

• YouTube
• 2 hours 5 minutes
• Self-Paced
• Free Video

CryptoCat

XML External Entity Injection (XXE) - Exploiting Web Application Vulnerabilities - Episode 3

Master XML External Entity Injection techniques through hands-on exploitation of Portswigger's Gin and Juice shop, covering file retrieval, SSRF attacks, and blind XXE data exfiltration methods.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

OWASP Foundation

Detecting CSRF Vulnerability Reliably - Programmatic Approach

Explore a programmatic approach to reliably detect CSRF vulnerabilities in web applications, overcoming common shortcomings of existing tools and improving automated security testing.

• YouTube
• 42 minutes
• Self-Paced
• Free Video

John Hammond

Command Injection Security in Docker Layers - Capture the Flag Tutorial

Dive into command injection vulnerabilities through a hands-on CTF challenge exploring Docker layers and container security, with practical exploitation techniques and defensive strategies.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

NahamSec

What is Server-Side Request Forgery - SSRF?

Explore Server-Side Request Forgery (SSRF): its definition, potential impacts, and importance in web security. Learn to identify and mitigate this critical vulnerability.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

Cyber Mentor

Learn to Hack WebApps - SSRF (Server-Side Request Forgery)

Explore server-side request forgery (SSRF) vulnerabilities in web applications, understanding attack techniques and mitigation strategies for enhanced cybersecurity.

• YouTube
• 2 hours 13 minutes
• Self-Paced
• Free Video

Cyber Mentor

Getting Started with Command Injection

Learn to exploit Command Injection vulnerabilities with a comprehensive guide covering theory, code review, and hands-on labs to enhance your cybersecurity skills and understanding of this dangerous vulnerability.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

HackerOne

H@cktivitycon 2020 - Graphing Out Internal Networks with CVE-2020-13379 - Unauthed Grafana SSRF

Discover and exploit a critical SSRF vulnerability in Grafana, impacting thousands of companies. Learn methodology, see a live demo, and explore reporting and mass-exploitation experiences.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Security BSides San Francisco

Don't Trust, Verify! - How I Found a CSRF Bug Hiding in Plain Sight

Discover how a hidden CSRF vulnerability was found in the popular gorilla/csrf Go library and learn to conduct vulnerability research on your own commonly used tools.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

nullcon

Project Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale

Discover Project Dusseldorf, a versatile out-of-band appsec platform used by Microsoft teams to detect vulnerabilities like SSRF, XXE, SSTI, XSS, and RCE at cloud scale, now being open-sourced.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

OWASP Foundation

Hunting Path Traversal in Open Source Software

Discover techniques for identifying and exploiting path traversal vulnerabilities in open-source software through practical hunting methodologies.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

BSidesLV

Security Pitfalls with Exec Commands in Software Integrations - A Quick Story

Explore security risks in software integrations, focusing on command injection attacks. Learn detection methods, prevention techniques, and real-world vulnerability analysis through a case study.

• YouTube
• 24 minutes
• Self-Paced
• Free Video