Back to roadmap
Web pentesting

Web Application Penetration Testing Study Plan

A milestone-based roadmap for web application pentesting fundamentals, tools, labs, reading, courses, certifications, and career networking.

Use this after Common Security Skills. Close as many checklist items as possible. Strong fundamentals and hands-on practice matter most for entry-level web security roles.

Expected pace

6 months

Fundamentals to entry-level readiness.

Role clarity

Pentesters find security vulnerabilities, assess risk, and exploit where possible as internal or external attackers.
Red teamers focus on one way in, then lateral movement and high-value data access.
Vulnerability assessment is not pentesting, but VAPT skills are common in pentester jobs.
Bug bounty is optional and depends on preference and time.
Pentesters vs Red TeamMobile Application Security Study Plan
Pentesting ConceptsTools of TradeLab PracticesBooksVideosBlogs and Other ReferencesCoursesCertificationsNetworking MattersWhom to Follow on Twitter

Section 1

Pentesting Concepts

6 weeks

Understand web and security fundamentals deeply: HTTP, headers, status codes, authentication, authorization, XSS, CSRF, injection, IDOR, JWT, and more.

Week 1-2: Basics

HTTP methods, PUT vs POST, UPDATE vs PATCH, and OPTIONS methodHTTP response status codes
Analyze what 200 means after malicious input.
Understand what to do after 403.
Try to trigger 500 and understand what it can reveal.
Learn status codes pentesters want to see.
HTTP headers, especially response headers
TCP 3-way handshake
How SSL works
Cybersecurity terminologiesEssential security concepts

Week 3-4: Security Concepts

Use OWASP Cheat Sheet Series to learn what each issue is, why it happens, how to exploit it, and how to mitigate it.

OWASP Cheat Sheet Series
Authentication and authorization implementation, bypass, and exploitation.
Session and cookie vulnerabilities, bypasses, and exploitation.
In-depth XSS.
REST concepts like CRUD.
Injection types, especially SQLi, RFI, and LFI.
Mass assignment.
CSP concepts.
SSRF.
Automated bruteforce.
Credential stuffing.
JWT tokens.
Encoding, decoding, and hashing basics.
Session fixation and session hijacking.
Third-party vulnerability checks and exploitation.
Black-box and white-box testing scope.
SAST vs DAST.
CORS.

Week 5-6: Advanced Security Skill Sets

OWASP Testing Guide hands-on practice.
Leverage vulnerability chains to achieve RCE.
Test for OS command injection.
Understand BOLA and BFLA causes and testing.
Weak cipher suites.
Advanced SQL injection.
XML injection and JSON injection.
SAML and LDAP injection.
NoSQL injection.
GraphQL injection.
XXE attacks.
Template injection.
Deserialization.

Section 2

Tools of Trade

2 weeks

Tools make pentesters efficient, but do not become tool-only. Learn each tool deeply: purpose, features, when to use it, and how it works.

Week 7-8: Essential Tools

Kali Linux
Burp Suite Pro or OWASP ZAP
Metasploit
nmap
dirb
nikto
fierce
dnsenum
sqlmap
Shodan
BeeF
Arachni
Wireshark
hydra
Cain and Abel
w3af

Section 9

Networking Matters

Build security community presence while learning. Connections, writing, and helping beginners improve your own understanding.

Make good LinkedIn contacts from security domain.
Find a mentor.
Make connections through online and offline security conferences.
Publish hacking articles, even basic concepts. Medium works.
Join webinars and conferences.
Help someone who is still a beginner.