Web Application Penetration testing Study Plan

August 29, 2026 ยท View on GitHub

This study plan is based on milestones. So, check how much you can cover and close the checkboxes. The more you close, the better candidate you are for the job role. Also, I assume you have already checked and are comfortable with Common Security Skills study plan.

Just to make sure that everyone understands what you need to learn to be a pentester. It is altogether different from bug bounty, Red Team etc. but to excel in any of those roles you should be good at pentesting. It's not necessary that you can be a Red Teamer or Bug bounty hunter if you know pentesting. But a red teamer is surely very good at pentesting. Also, Vulnerability assessment is not pentesting, however, VAPT is a common skills required for pentesters job.

In short:

  1. Pentesters are offensive security folks who try to find as many security vulnerabilities as possible, access the risk and exploit as much as possible. They can play as internal or external attackers for the organization.
  2. Red Teamers are least bothered of finding all security gaps, and their ultimate goal is to find one way in, exploit it and then escalate laterally through your system to access the juiciest data they can.
  3. It's totally upon your preference and timings that you should join bug bounty platform or not.

Read more here about Pentesters vs Red Team

Usually it will take you 6 months to be good at fundamentals to get a job at entry level.

If you are also interested in testing Android or iOS apps, read the Mobile Application Security Study Plan alongside this one.

ToC:

  1. Pentesting Concepts - 6 weeks
  2. Tools of Trade - 2 weeks
  3. Lab Practices - 8 weeks
  4. Books (Read 1-2 books) - 2-3 months
  5. Videos
  6. Courses - Try to complete at least one course (1-2 months)
  7. Certifications - on your bandwidth and wish

Pentesting Concepts

Duration: 6 weeks

Go with your pace, but make sure you understand the basic security concepts very well like HTTP Security Response headers, Bruteforce, DoS, XSS, CSRF, Injection, IDoR, JWT etc.

Week 1-2: Basics

  1. Understanding of various HTTP methods, PUT vs POST, UPDATE vs PATCH, leverage OPTIONS method
  2. Ability to understand response status codes.
    1. what if you got 200, when you tried something malicious
    2. what can we do if we get 403
    3. let's try to get 500 status code, and why so? What will it reveal.
    4. Try to understand each status code which as a pentester you would love to see.
  3. Understand HTTP headers very well, specially response headers. You would need it more often while doing pentest.
  4. TCP 3 way handshake
  5. How SSL works
  6. Basics of security terminologies
  7. Essentials Security Concepts

Week 3-4: Security Concepts

You can find majority of the security concepts at OWASP Cheatsheet

Understand the fundamental concepts on what it is, how it can be vulnerable and how you can either exploit it or mitigate it.

  1. Understanding how proper implementation of AuthN and AuthZ contribute to robust security. What can an attacker do to exploit it.
  2. How session and cookies can be vulnerable, bypassed or even exploited
  3. In-depth understanding of XSS
  4. Some REST concepts like CRUD.
  5. Different types of injections specially SQLi, RFI,LFI
  6. Mass Assignment
  7. CSP concepts
  8. SSRF
  9. Automated Bruteforce
  10. Credential Stuffing
  11. JWT Tokens
  12. Basic of encoding, decoding, hashing
  13. Session Fixation, Session Hijacking
  14. 3rd Party Vulnerability checks and exploitations
  15. Understand the work defined for black box and white box testing
  16. SAST vs DAST
  17. CORS

Week 5-6: Advance Level of security skill sets

  1. Very good at OWASP Testing Guide hands-on
  2. How to leverage a vulnerability to achieve RCE
  3. Learn how to test for OS Command Injection
  4. Understand what causes BOLA and BFLA and try to be good at testing these vulnerabilities
  5. Various weak cipher suites
  6. Advanced SQL Injection
  7. XML Injection, JSON Injection
  8. Understand SAML and LDAP Injection
  9. NoSQL Injection
  10. GraphQL Injection
  11. XXE Attacks
  12. Template Injection
  13. Deserialization

Tools of Trade

Duration: 2 weeks

They say tools are not everything but tools play an important role to make you a better and efficient penetration tester. But, don't just be tool junkie. Try to understand in-depth of each tool, its functionalities and when to use with how concept! I am not writing names of many tools for DAST, SAST etc like acunetix, appscan, checkmarx etc. Kali OS will have almost all the tools that you would need for pentest, but I would explicitly mention few of them here as well.

Week 7-8: Essential Tools

  1. Kali Linux (I am sure majority of us would be using this only)
  2. Burp Suite Pro or OWASP ZAP (Really a single tool for bread and butter ;) )
  3. Metasploit
  4. nmap (you would use it everytime you start with pentest)
  5. dirb
  6. nikto
  7. fierce
  8. dnsenum
  9. sqlmap
  10. Shodan
  11. BeeF
  12. Nuclei (template-based scanning; the actively maintained option for the automated-scanning role older tools used to fill)
  13. OWASP ZAP Automation Framework (scripted/CI-driven DAST)
  14. wireshark
  15. hydra
  16. Responder + hashcat or John the Ripper (credential capture and offline cracking)

Deprecated tools - know the name, don't build your workflow on them. You will still see these in old blog posts, courses and Kali screenshots. They are not maintained, so treat them as history only:

  1. Cain and Abel - last stable build 4.9.56 (April 2014), vendor site oxid.it defunct since ~2016, Windows-XP-era. Use Responder + hashcat/John instead.
  2. w3af - maintainer's last commit was February 2020, no new releases, community PRs unmerged. Use OWASP ZAP or Nuclei instead.
  3. Arachni - last release 2017, project abandoned by 2020. Use Nuclei, ZAP automation, or a commercial DAST instead.

AI-assisted recon and pentesting

Through 2025-2026 LLM-driven tooling became a normal part of the offensive toolkit. It does not replace understanding the vulnerability classes above - it speeds up the boring parts and hallucinates confidently, so verify everything it produces.

  1. AI copilots (human-in-the-loop): you drive the engagement and the model reads scanner output, suggests the next step, drafts payloads, or explains an unfamiliar stack. e.g. PentestGPT, LLM integrations inside Burp/Caido.
  2. Autonomous / agentic pentest platforms: point them at a target and they run a recon-exploit-report loop themselves. Commercial examples (XBOW, NodeZero) and open-source agent frameworks exist; results still need human validation and they must only ever run inside authorized scope.
  3. LLM-driven recon: summarizing large recon output, correlating subdomains/tech stacks/leaked data, and generating wordlists or fuzzing candidates.
  4. Learn the flip side too: if you are testing an application that itself uses an LLM, read the OWASP Top 10 for LLM Applications - prompt injection and insecure output handling are now in scope for web pentests.
  5. Rules of engagement matter more, not less: never paste client data, credentials or scoped findings into a public/consumer AI service.

Lab Practices

Duration: 8 weeks

Week 9-16: Hands-on Practice

  1. Kontra for OWASP Top 10 for Web 1a. RansomLeak Application Security Training - Interactive browser-based labs
  2. hackthebox
  3. tryhackme
  4. OWASP WebGoat
  5. OWASP JuiceShop
  6. PentesterLab
  7. AttackDefense Lab - Recommended (you would need paid subscription)
  8. DVWA

Books

  1. The Web Application Hacker's Handbook (read this book as the first thing or learn from web security academy)
  2. OWASP Web Security Testing Guide (WSTG) (read this as the 2nd book) - pair it with the current OWASP Top 10:2025 (released 6 November 2025, final version published January 2026). Two new categories vs. 2021: A03:2025 Software Supply Chain Failures (an expansion of the old A06 Vulnerable & Outdated Components) and A10:2025 Mishandling of Exceptional Conditions. Security Misconfiguration moved up to A02, and SSRF was folded into A01 Broken Access Control. The OWASP Top 10 2021 is still worth reading as the prior edition, since a lot of tooling, courses and job descriptions still reference it.
  3. The Hacker Playbook 3: Practical Guide To Penetration Testing
  4. Real World Bug Hunting
  5. Web Hacking 101 by Peter Yaworski - pdf

Videos

  1. Penetration Testing for Beginners - Youtube
  2. Web Security Course - Playlist

Blogs / Other References

  1. exploit-db
  2. cve
  3. schneier on security
  4. KrebsonSecurity

Courses

It's upto you to choose some paid or free courses to speed up what you have learned so far to test how much you understand under web pentesting category. You should choose lab based courses though.

  1. Cybrary
  2. Pentester academy - I liked few of its courses on
    1. Python for Pentesters
    2. JavaScript for Pentesters
    3. Pentesting with Metasploit
    4. WAP Challenges
    5. Web Application Pentesting
  3. Introduction to Web Security form Stanford
  4. Pentesting for beginners
  5. Pentesting from EdX
  6. Web Security Academy (You can ignore reading Web Application Hackers Handbook, if you are learning from here!)
  7. Computer Systems Security form MIT
  8. pwn.guide

Certifications

Certification gives you an entry for HR calls, but remember real hands-on experience can beat anything.

  1. CEH: not highly recommended, but good to start with if you don't know anything about security.
  2. eJPT
  3. eWPTXv2
  4. OSCP
  5. OSWE
  6. GPEN
  7. GWAPT

List of other famous cybersecurity certifications are mentioned here.

Networking matters

Once you are on track and now understands the heat, it's time to:

  1. Make some good LinkedIn contacts from security domain
  2. Find a mentor
  3. Make connections through various security conference online/offline
  4. Publish some good hacking articles, may be basic concepts but you must publish. Choose medium
  5. Join webinars, conferences
  6. help someone who is still a beginner

By the time you cover all these checklists, you will be already on a way to have a good start in web security job role. All the best!

Whom to follow on X (formerly Twitter)

Why? Because you will see lots of security professionals very active here and sharing cool stuffs often. (The platform was renamed X in 2023; the twitter.com links below still redirect. Many of these folks now also post on Mastodon, Bluesky and LinkedIn.)

  1. Dave Kennedy
  2. Kevin Mitnick
  3. The Hacker News(THN)
  4. PortSwigger
  5. Dark Reading
  6. Defcon
  7. Nullcon
  8. NahamSec
  9. TryHackMe
  10. HackerOne
  11. BugCrowd
  12. OWASP
  13. Troy Hunt
  14. Jason Haddix
  15. Security Princess - Parisa Tabriz
  16. Binni Shah
  17. Random Robbie
  18. TomNomNom
  19. Aditya Shende
  20. Infosec Community
  21. Hacking Articles
  22. harsh Bothra

Interview Questions

Possible Web Security interview questions is shared at different github repo to keep it aligned with career roadmap guide.