Skip to main content
Sign up
Advanced15 modules · 150 hours

Web Security

This path covers web application and API security in depth, built around the OWASP Top 10. You will find vulnerabilities with Burp Suite, exploit them in Falcon Academy labs and write secure fixes at code level. On real systems, this kind of testing is carried out only with written authorisation.

Start the pathAll paths

What you will learn

Key topics

OWASP Top 10APIAuthenticationSQLi and XSSSSRFBurp Suite
  1. 01

    Web applications and Burp Suite

    HTTP, sessions and cookies from a security perspective, and analysing requests in Burp Suite.

  2. 02

    Injection flaws

    SQL injection and other injection classes: root causes, detection and impact.

  3. 03

    Client-side flaws

    XSS, CSRF and the browser's security mechanisms.

  4. 04

    Authentication and sessions

    Weaknesses in login, password reset, tokens and session management.

  5. 05

    API security and SSRF

    Object-level authorisation flaws, API weaknesses and server-side requests.

  6. 06

    Secure fixes

    Code-level remediation for each vulnerability, code review and retesting.

Attack and defence

The attacker’s side

  • Find and prove OWASP Top 10 vulnerabilities in lab applications.
  • Intercept and modify requests in Burp Suite to test application logic.
  • Identify flaws in authentication, sessions and API authorisation.
  • See the real impact of SQLi, XSS and SSRF.

The defender’s side

  • Apply parameterised queries, input validation and output encoding.
  • Configure secure session and token handling.
  • Design authorisation and rate limits for APIs.
  • Confirm by retesting that a fix has closed the vulnerability.

Who it is for

  • Developers who want to master web application security.
  • Specialists preparing for a career in penetration testing.
  • Teams responsible for code review and secure development.

By the end

  • Test web applications and APIs systematically against the OWASP Top 10.
  • Find vulnerabilities with Burp Suite and demonstrate their impact.
  • Propose and verify a secure fix for every finding.
  • Document findings in language developers can act on.

Other paths

Beginner

7 modules · 60 hours

Security Fundamentals

Your first step into cybersecurity: Linux, the terminal, core threats and essential tools.

  • Attack: How attacks begin: weak passwords, exposed services and phishing
  • Defence: Configure systems correctly, restrict access and spot suspicious activity
Learn more
Beginner

1 module · 60 hours

Networking Basics

Understand how networks work: TCP/IP, DNS, HTTP and traffic analysis.

  • Attack: See open ports, unencrypted protocols and weak points in traffic
  • Defence: Analyse traffic, detect anomalies and configure services correctly
Learn more
Beginner

1 module · 60 hours

Information Security

Risk, access control, standards and policies: managing security as a system.

  • Attack: See where data leaks begin: excessive privileges and weak processes
  • Defence: Assess risk, restrict access and introduce clear security policies
Learn more

Capture your first flag today

Create a free account and access 700+ hands-on challenges.

Sign up freeCorporate request