Web Application Penetration testing Study Plan
August 29, 2026 ยท View on GitHub
This study plan is based on milestones. So, check how much you can cover and close the checkboxes. The more you close, the better candidate you are for the job role. Also, I assume you have already checked and are comfortable with Common Security Skills study plan.
Just to make sure that everyone understands what you need to learn to be a pentester. It is altogether different from bug bounty, Red Team etc. but to excel in any of those roles you should be good at pentesting. It's not necessary that you can be a Red Teamer or Bug bounty hunter if you know pentesting. But a red teamer is surely very good at pentesting. Also, Vulnerability assessment is not pentesting, however, VAPT is a common skills required for pentesters job.
In short:
- Pentesters are offensive security folks who try to find as many security vulnerabilities as possible, access the risk and exploit as much as possible. They can play as internal or external attackers for the organization.
- Red Teamers are least bothered of finding all security gaps, and their ultimate goal is to find one way in, exploit it and then escalate laterally through your system to access the juiciest data they can.
- It's totally upon your preference and timings that you should join bug bounty platform or not.
Read more here about Pentesters vs Red Team
Usually it will take you 6 months to be good at fundamentals to get a job at entry level.
If you are also interested in testing Android or iOS apps, read the Mobile Application Security Study Plan alongside this one.
ToC:
- Pentesting Concepts - 6 weeks
- Tools of Trade - 2 weeks
- Lab Practices - 8 weeks
- Books (Read 1-2 books) - 2-3 months
- Videos
- Courses - Try to complete at least one course (1-2 months)
- Certifications - on your bandwidth and wish
Pentesting Concepts
Duration: 6 weeks
Go with your pace, but make sure you understand the basic security concepts very well like HTTP Security Response headers, Bruteforce, DoS, XSS, CSRF, Injection, IDoR, JWT etc.
Week 1-2: Basics
- Understanding of various HTTP methods, PUT vs POST, UPDATE vs PATCH, leverage OPTIONS method
- Ability to understand response status codes.
- what if you got 200, when you tried something malicious
- what can we do if we get 403
- let's try to get 500 status code, and why so? What will it reveal.
- Try to understand each status code which as a pentester you would love to see.
- Understand HTTP headers very well, specially response headers. You would need it more often while doing pentest.
- TCP 3 way handshake
- How SSL works
- Basics of security terminologies
- Essentials Security Concepts
Week 3-4: Security Concepts
You can find majority of the security concepts at OWASP Cheatsheet
Understand the fundamental concepts on what it is, how it can be vulnerable and how you can either exploit it or mitigate it.
- Understanding how proper implementation of AuthN and AuthZ contribute to robust security. What can an attacker do to exploit it.
- How session and cookies can be vulnerable, bypassed or even exploited
- In-depth understanding of XSS
- Some REST concepts like CRUD.
- Different types of injections specially SQLi, RFI,LFI
- Mass Assignment
- CSP concepts
- SSRF
- Automated Bruteforce
- Credential Stuffing
- JWT Tokens
- Basic of encoding, decoding, hashing
- Session Fixation, Session Hijacking
- 3rd Party Vulnerability checks and exploitations
- Understand the work defined for black box and white box testing
- SAST vs DAST
- CORS
Week 5-6: Advance Level of security skill sets
- Very good at OWASP Testing Guide hands-on
- How to leverage a vulnerability to achieve RCE
- Learn how to test for OS Command Injection
- Understand what causes BOLA and BFLA and try to be good at testing these vulnerabilities
- Various weak cipher suites
- Advanced SQL Injection
- XML Injection, JSON Injection
- Understand SAML and LDAP Injection
- NoSQL Injection
- GraphQL Injection
- XXE Attacks
- Template Injection
- Deserialization
Tools of Trade
Duration: 2 weeks
They say tools are not everything but tools play an important role to make you a better and efficient penetration tester. But, don't just be tool junkie. Try to understand in-depth of each tool, its functionalities and when to use with how concept! I am not writing names of many tools for DAST, SAST etc like acunetix, appscan, checkmarx etc. Kali OS will have almost all the tools that you would need for pentest, but I would explicitly mention few of them here as well.
Week 7-8: Essential Tools
- Kali Linux (I am sure majority of us would be using this only)
- Burp Suite Pro or OWASP ZAP (Really a single tool for bread and butter ;) )
- Metasploit
- nmap (you would use it everytime you start with pentest)
- dirb
- nikto
- fierce
- dnsenum
- sqlmap
- Shodan
- BeeF
- Nuclei (template-based scanning; the actively maintained option for the automated-scanning role older tools used to fill)
- OWASP ZAP Automation Framework (scripted/CI-driven DAST)
- wireshark
- hydra
- Responder + hashcat or John the Ripper (credential capture and offline cracking)
Deprecated tools - know the name, don't build your workflow on them. You will still see these in old blog posts, courses and Kali screenshots. They are not maintained, so treat them as history only:
- Cain and Abel - last stable build 4.9.56 (April 2014), vendor site oxid.it defunct since ~2016, Windows-XP-era. Use Responder + hashcat/John instead.
- w3af - maintainer's last commit was February 2020, no new releases, community PRs unmerged. Use OWASP ZAP or Nuclei instead.
- Arachni - last release 2017, project abandoned by 2020. Use Nuclei, ZAP automation, or a commercial DAST instead.
AI-assisted recon and pentesting
Through 2025-2026 LLM-driven tooling became a normal part of the offensive toolkit. It does not replace understanding the vulnerability classes above - it speeds up the boring parts and hallucinates confidently, so verify everything it produces.
- AI copilots (human-in-the-loop): you drive the engagement and the model reads scanner output, suggests the next step, drafts payloads, or explains an unfamiliar stack. e.g. PentestGPT, LLM integrations inside Burp/Caido.
- Autonomous / agentic pentest platforms: point them at a target and they run a recon-exploit-report loop themselves. Commercial examples (XBOW, NodeZero) and open-source agent frameworks exist; results still need human validation and they must only ever run inside authorized scope.
- LLM-driven recon: summarizing large recon output, correlating subdomains/tech stacks/leaked data, and generating wordlists or fuzzing candidates.
- Learn the flip side too: if you are testing an application that itself uses an LLM, read the OWASP Top 10 for LLM Applications - prompt injection and insecure output handling are now in scope for web pentests.
- Rules of engagement matter more, not less: never paste client data, credentials or scoped findings into a public/consumer AI service.
Lab Practices
Duration: 8 weeks
Week 9-16: Hands-on Practice
- Kontra for OWASP Top 10 for Web 1a. RansomLeak Application Security Training - Interactive browser-based labs
- hackthebox
- tryhackme
- OWASP WebGoat
- OWASP JuiceShop
- PentesterLab
- AttackDefense Lab - Recommended (you would need paid subscription)
- DVWA
Books
- The Web Application Hacker's Handbook (read this book as the first thing or learn from web security academy)
- OWASP Web Security Testing Guide (WSTG) (read this as the 2nd book) - pair it with the current OWASP Top 10:2025 (released 6 November 2025, final version published January 2026). Two new categories vs. 2021: A03:2025 Software Supply Chain Failures (an expansion of the old A06 Vulnerable & Outdated Components) and A10:2025 Mishandling of Exceptional Conditions. Security Misconfiguration moved up to A02, and SSRF was folded into A01 Broken Access Control. The OWASP Top 10 2021 is still worth reading as the prior edition, since a lot of tooling, courses and job descriptions still reference it.
- The Hacker Playbook 3: Practical Guide To Penetration Testing
- Real World Bug Hunting
- Web Hacking 101 by Peter Yaworski - pdf
Videos
Blogs / Other References
Courses
It's upto you to choose some paid or free courses to speed up what you have learned so far to test how much you understand under web pentesting category. You should choose lab based courses though.
- Cybrary
- Pentester academy - I liked few of its courses on
- Python for Pentesters
- JavaScript for Pentesters
- Pentesting with Metasploit
- WAP Challenges
- Web Application Pentesting
- Introduction to Web Security form Stanford
- Pentesting for beginners
- Pentesting from EdX
- Web Security Academy (You can ignore reading Web Application Hackers Handbook, if you are learning from here!)
- Computer Systems Security form MIT
- pwn.guide
Certifications
Certification gives you an entry for HR calls, but remember real hands-on experience can beat anything.
- CEH: not highly recommended, but good to start with if you don't know anything about security.
- eJPT
- eWPTXv2
- OSCP
- OSWE
- GPEN
- GWAPT
List of other famous cybersecurity certifications are mentioned here.
Networking matters
Once you are on track and now understands the heat, it's time to:
- Make some good LinkedIn contacts from security domain
- Find a mentor
- Make connections through various security conference online/offline
- Publish some good hacking articles, may be basic concepts but you must publish. Choose medium
- Join webinars, conferences
- help someone who is still a beginner
By the time you cover all these checklists, you will be already on a way to have a good start in web security job role. All the best!
Whom to follow on X (formerly Twitter)
Why? Because you will see lots of security professionals very active here and sharing cool stuffs often. (The platform was renamed X in 2023; the twitter.com links below still redirect. Many of these folks now also post on Mastodon, Bluesky and LinkedIn.)
- Dave Kennedy
- Kevin Mitnick
- The Hacker News(THN)
- PortSwigger
- Dark Reading
- Defcon
- Nullcon
- NahamSec
- TryHackMe
- HackerOne
- BugCrowd
- OWASP
- Troy Hunt
- Jason Haddix
- Security Princess - Parisa Tabriz
- Binni Shah
- Random Robbie
- TomNomNom
- Aditya Shende
- Infosec Community
- Hacking Articles
- harsh Bothra
Interview Questions
Possible Web Security interview questions is shared at different github repo to keep it aligned with career roadmap guide.