Web Application Penetration Testing Courses and Certifications

Cyber Mentor

How to Hack WordPress - Exploiting Plugins - Part 2

A hands-on lab walkthrough of enumerating WordPress plugins and exploiting them, including a remote code execution example.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Cyber Mentor

Web App Hacking with Caido.io

A short course on web app hacking centered on Caido.io.

• YouTube
• 1 hour 58 minutes
• Self-Paced
• Free Video

HackerSploit

Exploiting Arbitrary File Upload

Exploit an arbitrary file upload vulnerability in a web application to obtain initial access to a Linux target.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Cyber Mentor

How to Hack WordPress

Explore WordPress core files, enumerate sites and plugins, scan with WPScan, and try attacking user accounts.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Cyber Mentor

Web App Hacking - File Inclusion Attacks

Explore file inclusion attacks in web applications through a focused web hacking session.

• YouTube
• 1 hour 50 minutes
• Self-Paced
• Free Video

Cyber Mentor

Web App Hacking - File Upload Attacks

A focused look at file upload attacks in web apps.

• YouTube
• 1 hour 59 minutes
• Self-Paced
• Free Video

Cyber Mentor

Learn to Hack Live - Command Injection

A live hacking session focused on command injection, framed around penetration testing and application security.

• YouTube
• 2 hours 5 minutes
• Self-Paced
• Free Video

CryptoCat

XML External Entity Injection (XXE) - Exploiting Web Application Vulnerabilities - Episode 3

Master XML External Entity Injection techniques through hands-on exploitation of Portswigger's Gin and Juice shop, covering file retrieval, SSRF attacks, and blind XXE data exfiltration methods.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

John Hammond

Command Injection Security in Docker Layers - Capture the Flag Tutorial

Dive into command injection vulnerabilities through a hands-on CTF challenge exploring Docker layers and container security, with practical exploitation techniques and defensive strategies.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Bill Buchanan OBE

Web Attacks

A practical introduction to web attacks using HTTP interception, vulnerable applications, and demonstrations of injection and authentication flaws.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

BSidesLV

Security Pitfalls with Exec Commands in Software Integrations - A Quick Story

Explore security risks in software integrations, focusing on command injection attacks. Learn detection methods, prevention techniques, and real-world vulnerability analysis through a case study.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

OWASP Foundation

Hunting Path Traversal in Open Source Software

Discover techniques for identifying and exploiting path traversal vulnerabilities in open-source software through practical hunting methodologies.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

Security BSides San Francisco

Don't Trust, Verify! - How I Found a CSRF Bug Hiding in Plain Sight

Discover how a hidden CSRF vulnerability was found in the popular gorilla/csrf Go library and learn to conduct vulnerability research on your own commonly used tools.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

nullcon

Project Dusseldorf: Finding Out-Of-Band Vulnerabilities At Cloud Scale

Discover Project Dusseldorf, a versatile out-of-band appsec platform used by Microsoft teams to detect vulnerabilities like SSRF, XXE, SSTI, XSS, and RCE at cloud scale, now being open-sourced.

• YouTube
• 39 minutes
• Self-Paced
• Free Video

How to Hack OWASP Juice Shop - A Guided Walkthrough Showing All Solutions

A challenge-by-challenge walkthrough of OWASP Juice Shop vulnerabilities, from XSS and injection to broken access control and authentication.

• YouTube
• 7 hours
• Self-Paced
• Free Video