WEB-200: Web Attacks with Kali Linux

The WEB-200 course provides a comprehensive overview of web application vulnerabilities and their exploitation using tools available in Kali Linux. The purpose of this course is to explore the fundamental concepts needed to begin a much longer journey within Information Security, Penetration Testing, or Application Security. Web applications often represent the largest attack surface for an organization - anyone with a browser and internet access can discover and interact with a public-facing web application. By mastering the skills and techniques within this course, you will be prepared to identify and exploit vulnerabilities in web applications.

WEB-200 has topics and examples covering a large number of web application skills, including:

• Leveraging various types of Cross-Site Scripting (XSS) vulnerabilities using our Kali Linux environment
• Performing web application reconnaissance, enumerating web applications, and sourcing or generating wordlists
• Using fuzzing tools for SQL Injection vulnerabilities and sqlmap for automated site crawls, but also when a manual approach is preferred
• Mastering Burp Suite tools: Repeater, Comparer, Intruder, and Decoder, to be effective web assessors
• Understanding the impact of Server-side Request Forgery (SSRF) including how the vulnerability occurs, and how it interacts with the vulnerable server through a case study with two SSRF vulnerabilities found in a real-world application.

WEB-200 is organized into 16 modules, each with detailed explanations, specific case studies, and hands-on activities to emphasize the discovery, testing, and exploitation of these vulnerabilities to enhance offensive security skills. After the completion of the modules, learners will be able to test their knowledge on any one of 9 Challenge labs. Once prepared, the learner can sit for the OffSec Web Assessor (OSWA) certification, earning the right to share this accomplishment with employers.

WEB-200 is designed for learners who want to build foundational skills in professional web application assessments. The course material will help clarify the attacks and techniques used by malicious actors against web applications. Note that basic Linux, networking, and scripting skills will help significantly with this course.