Basic to Advanced Web Penetration Testing
A 45-day intensive, lab-driven programme that takes you from web security basics to advanced exploitation, reporting, and a capstone pentest on a live target.
Course Overview
ETSEC 001 is a structured web penetration testing programme built to develop practical offensive security skills. The course follows a methodology-driven approach that mirrors how actual pentest engagements work - from scoping and recon through exploitation, reporting, and capstone evaluation.
You will not just study concepts. You will practice on vulnerable applications like DVWA, WebGoat, and custom labs while following methodologies like PTES and the OWASP Testing Guide. The goal is to help you understand web application security from an attacker's perspective.
This is a technical training programme by ETSEC Inc. It builds practical skills, but it is not a degree or a placement guarantee. What you take away from it depends largely on how much effort you put in.
What You Will Learn
Who Is This For?
Recommended Prerequisites
• Basic understanding of the web (HTTP, browsers, how websites work)
• Basic Linux command-line comfort helps but is not mandatory - essentials are covered in the course
• No prior pentesting experience required
Training Approach: 40% Theory - Concepts, attack anatomy, methodology, and secure design principles. 60% Practical - Guided labs, CTF-style exercises, and capstone projects. Most of your time will be spent inside tools, terminals, and Burp Suite.
Course Curriculum
Foundations & Methodology
- •Intro to web pentesting, roles, legal aspects, and rules of engagement
- •Lab setup: Kali Linux, DVWA, WebGoat, and other vulnerable apps
- •Pentesting methodologies: PTES, OWASP Testing Guide
- •HTTP/S requests, responses, headers, and methods
- •Using Burp Suite and OWASP ZAP to intercept and analyse traffic
- •Encodings (HTML, URL, Base64) and Same-Origin Policy basics
- •Passive and active recon techniques
Reconnaissance & Fingerprinting
- •Subdomain and virtual host enumeration
- •Infrastructure fingerprinting - servers, modules, tech stack
- •Application and framework detection; mapping the attack surface
- •Discovering hidden files, backups, and exposed source code
- •Identifying misconfigurations and information leakage
Cross-Site Scripting (XSS)
- •XSS types - reflected, stored, DOM-based
- •Exploiting reflected and stored XSS
- •Using BeEF for browser exploitation scenarios
- •Cookie theft, session hijacking concepts
- •Input validation and output encoding as mitigations
- •CTF-style XSS challenge exercises
SQL Injection (SQLi)
- •SQLi types, vulnerable patterns, and impact
- •Manual exploitation: error-based, UNION-based data extraction
- •Blind SQLi - boolean-based and time-based techniques
- •Using SQLMap for automated SQLi testing
- •Advanced: pivoting from SQLi to deeper access (controlled lab)
Authentication & Authorisation
- •Weak password policies, brute force, and user enumeration
- •Session weaknesses: fixation, hijacking, poor cookie flags
- •Authorisation flaws: IDOR, missing function-level access controls
- •CSRF concepts and exploitation
- •Password reset vulnerabilities and insecure flows
File & Business Logic Attacks
- •Path traversal and arbitrary file read
- •Local and Remote File Inclusion (LFI/RFI)
- •Unrestricted file uploads and web shells
- •Business logic flaws - bypassing workflows, price manipulation
- •API security testing fundamentals with Postman and Burp
Reporting & Advanced Topics
- •Clickjacking and security headers (X-Frame-Options, CSP basics)
- •XML External Entity (XXE) vulnerabilities
- •Advanced business logic and complex workflows
- •Professional pentest reporting - structure, executive summary, PoC, remediation
- •Capstone preparation: engagement mindset, cleanup, post-engagement actions
Revision & Capstone Evaluation
- •Trainer revisits topics based on batch feedback
- •Additional labs and mini-CTF exercises to reinforce concepts
- •Full engagement on a previously unseen vulnerable web application
- •End-to-end testing: recon to exploitation to reporting
- •Evaluation based on practical skills and submitted report
Tools & Technologies
OS & Environment
Web Proxies
Scanning & Recon
Attack Frameworks
Vulnerable Targets
Other Tools
After Completing This Course
You Also Receive
• ETSEC Course Completion Certificate
• A capstone project report suitable for portfolio use
• Lab guides and reference materials
Career Paths & Market Salaries
Roles where these skills are actively used in the Indian market. Salary figures are indicative ranges based on publicly available data and may vary by location, experience and organisation.
Web Application Penetration Tester
5 – 15 LPATest web applications for security vulnerabilities following methodologies like OWASP and PTES. Most security consulting firms in India hire at this level.
Security Consultant
6 – 18 LPAPerform security assessments for clients across industries. Firms like ETSEC, Deloitte, and boutique security shops regularly look for these skills.
Bug Bounty Hunter
Variable (freelance)Find and report vulnerabilities in production applications for bounties. Platforms like HackerOne, Bugcrowd, and Intigriti are popular with Indian researchers.
Application Security Engineer
8 – 20 LPAWork with development teams to identify flaws early and build secure applications. Growing demand in product companies and startups.
SOC Analyst (with offensive skills)
4 – 10 LPASOC analysts who understand attack techniques tend to triage better and move up faster. This course gives you that attacker perspective.
Red Team Operator
10 – 25 LPASimulate real-world attacks against organisations. Requires experience beyond this course, but web pentesting is the starting point for most red teamers.
Why Train With ETSEC?
Curriculum designed by practising pentesters at ETSEC Inc.
Realistic lab environments - you practise on actual vulnerable applications, not just theory
Methodology-driven approach: PTES and OWASP Testing Guide, not random tool demos
Professional reporting skills are covered - an often-overlooked but critical part of pentesting
Capstone evaluation mirrors a real client engagement
What Participants Say
“This course connected the dots between tools, methodology, and actual project work.”
- Rahul S.
“The capstone was like working on a real engagement. Easily the most useful part of the course.”
- Priya M.
How to Enroll
Click 'Enroll Now'
Hit the Enroll button above. You will be redirected to our secure Razorpay payment page.
Complete Payment
Pay via UPI, card, net banking, or wallet. You will receive a confirmation email from Razorpay.
Share Details
Send your payment confirmation to contact@etsecinc.com or call +91 86885 78412.
Start Learning
Get added to your batch group, receive lab access, and begin training as per the batch schedule.
Frequently Asked Questions
Yes. The course starts with fundamentals - lab setup, web basics, and methodology - before moving to advanced topics. No prior pentesting experience needed.
Delivery mode may vary by batch. Contact us for current availability (online, offline, or hybrid).
You will get course notes, references, and lab guides. Recording availability depends on the batch format - please confirm when enrolling.
There is no external certification exam. The course has internal assessments and a capstone evaluation where you perform a full pentest on an unseen target and submit a report.
This is a skill-development training programme, not a placement service. The course builds practical skills and a portfolio-ready capstone project that can strengthen your profile. Actual outcomes depend on your effort, experience, and market conditions.
Interested in this course?
Get in touch to learn about upcoming batches, fees, and enrollment.