Level up your cyber skills game and <br /> save 20% on a <span class="font-bold">Learn One</span> subscription

Level up your cyber skills game and
save 20% on a Learn One subscription

Get 20% off
WEB-200: Foundational Web Application Assessments with Kali Linux

WEB-200: Foundational Web Application Assessments with Kali Linux

OffSec’s Foundational Web Application Assessments with Kali Linux (WEB-200) course introduces web application security testing methodology, tools, and techniques in a hands-on, self-paced environment. Learners gain a deep understanding of common web vulnerabilities and how to exploit them responsibly.

Individuals completing the online training course and passing its exhaustive exam earn the OffSec Web Assessor (OSWA) certification. This credential demonstrates your ability to identify and exploit vulnerabilities in web applications. The OSWA stands out in the web security field, reflecting a commitment to the hands-on skills employers seek.

OSWA Certification Badge

Topics covered in the Foundational Web Application Assessments with Kali Linux course (WEB-200)

  • Tools for the Web Assessor

    Gain hands-on experience with industry-standard tools like Burp Suite, OWASP ZAP, and sqlmap, used by web application penetration testers to identify security vulnerabilities, exploit weaknesses, and assess the security posture of web applications.

  • Cross-Site Scripting (XSS) Introduction, Discovery, Exploitation and Case Study

    Learn how attackers inject malicious code into web pages to hijack user sessions, steal sensitive data, or deface websites. Discover how to identify and exploit XSS vulnerabilities, and understand the different types of XSS attacks. Explore real-world case studies to learn from past incidents and strengthen your defenses.

  • Cross-Site Request Forgery (CSRF)

    Uncover how attackers trick authenticated users into performing unintended actions on web applications. Learn how to identify and exploit CSRF vulnerabilities, and explore practical mitigation techniques to protect against these attacks. Understand the impact of CSRF on user trust and data integrity.

  • Exploiting CORS Misconfigurations

    Dive into the security risks associated with Cross-Origin Resource Sharing (CORS) misconfigurations. Learn how attackers exploit these vulnerabilities to bypass access controls and access sensitive data. Understand how to identify and fix CORS misconfigurations to ensure secure cross-origin communication.

  • Database Enumeration

    Master techniques to gather sensitive information about a web application’s database structure and content. Learn how attackers leverage this information to craft targeted attacks. Explore various database enumeration methods and learn to implement countermeasures to protect against them.

  • SQL Injection (SQLi)

    Learn how to exploit vulnerabilities in web applications that interact with databases, potentially leading to data compromise, unauthorized access, or website defacement. Understand the different types of SQL Injection attacks and the impact they can have on an organization’s security posture. Explore techniques for preventing and mitigating SQL Injection vulnerabilities.

  • Directory Traversal

    configuration information, or source code. Learn to identify and exploit directory traversal vulnerabilities, and understand how to prevent unauthorized access to restricted areas of a web server.

  • XML External Entity (XXE) Processing

    Explore how attackers manipulate XML processors to access files, execute commands, or perform denial-of-service attacks. Understand the mechanics of XXE attacks and the potential consequences. Learn to secure XML parsers and prevent XXE vulnerabilities in web applications.

  • Server-Side Template Injection (SSTI)

    Understand how attackers inject code into web application templates, potentially leading to remote code execution, information disclosure, or privilege escalation. Learn how to identify and exploit SSTI vulnerabilities and explore mitigation techniques to protect your web applications.

  • Server-Side Request Forgery (SSRF)

    Learn how attackers force a web application to make requests to internal or external systems, potentially leading to data exfiltration, service disruption, or access to internal resources. Understand the various SSRF attack vectors and implement countermeasures to prevent unauthorized requests.

How to enroll

Course + Certification Exam Bundle

Course + Cert
Exam Bundle

$1,649

One-time payment

More information

# of Courses

1

Days of lab access

90

# of Exam attempts included

1

20% off for a limited time

Learn One

Learn
One

$2,599

$2,079

Billed annually*

More information

# of Courses

1

Days of lab access

365

# of Exam attempts included

2

Fundamental content

Unlimited

Fundamental learning paths and assessments

Included

PEN-103 & KLCP Exam

Included

PEN-210 & OWSP Exam

Included

Learn Unlimited

Learn
Unlimited

$5,799/year

Billed annually*

More information

Recommended # of learners

2-9

# of Exam attempts included

Unlimited

Subscription Term

Annual

OffSec Learning Library Access

All access

Labs for every course

Included

# of Courses

All

Days of lab access

365

Fundamental content

Unlimited

PEN-103 & KLCP Exam

Included

PEN-210 & OWSP Exam

Included

# of Courses

1

1

All

Days of lab access

90

365

365

# of Exam attempts included

1

2

Fundamental content

N/A

PEN-103 & KLCP Exam

N/A

Included

Included

PEN-210 & OWSP Exam

N/A

Included

Included

N/A

Included

Included

Financing is now available through Climb Credit with as little as 0% APR and up to 36 monthly payments, excluding Learn Unlimited. State exclusions may apply. Learn more.

Once started, 90 day lab access cannot be paused.

Buying for a team?

What our community is saying

Community Discord Member

Community Discord Member

Hi all. I just wanted to say that I really like the way the OSWA course material teaches XSS. I had notions of it, but the way it's all presented, and the fact that there are VMs you can start that let us break the problem into smaller problems (an eval sandbox that just executes whatever javascript you throw at it, and several sample apps that are each vulnerable to a different variant of XSS), makes for a very pleasant learning experience.

Andy Olchawa

Andy Olchawa

Offensive Security Professional

After obtaining my OSCP certification, I initially believed that OSWA would be a quick and easy victory. However, I soon realized that I had greatly underestimated its difficulty. The web represents the largest attack surface, and while I was familiar with most web vulnerability classes and had some prior experience in black-box web pentesting, the WEB-200 course introduced a multitude of variations I had never even considered. The challenges were far from easy, and it was evident that their intention was to evaluate not only technical skills but also the ability to think outside the box. Also, awesome experience, lots of fun!

Supercharge your cybersecurity career with the OSWA

Become an in-demand cybersecurity professional

  • Master web vulnerability identification with hands-on training

    Develop the essential skills used by web application penetration testers, through practical exercises and lab environments.

  • Increase your value in the application security field

    OSWA-certified penetration testers demonstrate proficiency in safeguarding web applications and protecting sensitive data.

  • Expand your web application security toolkit

    Gain proficiency in a wide range of assessment tools and methodologies, making you an indispensable asset for securing web applications.

  • Advance your career in web application security

    Explore exciting roles like web application penetration tester, application security engineer, or security consultant by understanding web security threats and mitigation techniques.

  • Demonstrate your web application security knowledge

    The OSWA certification signifies a strong foundational understanding of web application security in an evolving threat landscape.

Open doors to exciting cybersecurity roles

  • Web Application Penetration Tester

    Perform security assessments to identify and exploit vulnerabilities in web applications.

  • Certified Application Security Engineer

    Build and integrate security measures into web applications throughout the development lifecycle.

  • Vulnerability Researcher

    Discover new web application vulnerabilities, develop exploits, and responsibly disclose them.

  • Security Consultant (Web Focus)

    Advise organizations on web application security strategies, conduct risk assessments, and implement protection solutions.

  • Bug Bounty Hunter

    Discover and report web application vulnerabilities within bug bounty programs for potential rewards.

FAQ

  • What is the OSWA exam?

    The Offensive Security Web Assessor (OSWA) exam is a rigorous, proctored 24-hour practical assessment of your web application security skills. You’ll demonstrate your ability to identify and exploit vulnerabilities in web applications within a live lab environment. Following the exam, you have an additional 24 hours to submit a well-structured penetration testing report.

  • What format is the OSWA exam in?

    The OSWA exam is entirely hands-on. You will be given access to a lab environment and tasked with compromising web applications, demonstrating your practical web application penetration testing abilities.

  • Who is the WEB-200 course for?

    The WEB-200 course is ideal for security professionals seeking to enhance their web application security testing skills and earn the OSWA certification. It’s designed for individuals with knowledge of web development technologies and basic familiarity with Linux systems.

  • What are the prerequisites for WEB-200?

    While there are no formal prerequisites, it’s strongly recommended that you have a basic understanding of:

    • Web development technologies (HTML, CSS, JavaScript)
    • Networking Fundamentals
    • Linux operating system basics
    • All of the above can be found in our Web Application Assessment Essentials Learning Path, which will give you the skills necessary for success in this course.
  • What competencies will I gain?

    Upon completing WEB-200 and successfully passing the OSWA exam, you’ll have mastered core web application security testing methodologies, including:

    • Web application architecture analysis
    • Vulnerability scanning and identification
    • Manual exploitation techniques
    • Client-side attack vectors
    • Reporting and communication of findings
  • How does OffSec support my online journey?

    Throughout the online training course, you’ll have access to:

    • A virtual lab environment for hands-on practice
    • Extensive course information and materials, including videos and exercises
    • A vibrant online community of students and OffSec professionals
  • What is the exam retake policy?

    For details on exam retakes, please refer to OffSec’s official policies.

  • Can I extend my lab time?

    For information on lab extensions, please refer to OffSec’s official policies.

OffSec Web Application Assessment Courses & Certifications

Advance your cybersecurity career with OffSec

  • Start your journey

    Establish a strong foundation in web application security with the Web Application Assessment Essentials Learning Path.

  • Become a web application security tester

    Dive into the heart of web security with the Foundational Web Application Assessments with Kali Linux (WEB-200) course. Learn to identify and exploit vulnerabilities in web applications.

  • Enhance your web security expertise

    OffSec’s Learning Paths and Courses help you develop your web security skills. Explore advanced web attacks, API security, and cloud security to become a well-rounded web security professional.

  • Become a web application security specialist

    Specialize in securing web applications by exploring additional courses and Learning Paths that focus on advanced penetration testing, secure coding practices, and cloud-native security.

Start learning with OffSec

Most
popular

Course + Cert
Exam Bundle

$1,649/once

The bundle includes 90 days of access to a single course, the associated labs and a single exam attempt.

Buy now
20%
off

Learn
One

$2,599/year*

$2,079/year*

One year of lab access alongside a single course plus two exam attempts.

Get 20% off
All
access

Learn
Unlimited

$5,799/year*

Unlimited OffSec Learning Library access plus unlimited exam attempts for one year.

Contact us
Large teams

Learn
Enterprise

Get a quote

Flexible terms and volume discounts available.

Contact us
*Subscription auto-renews unless canceled.
Graduation cap icon colored in with a gradient fading from purple to teal

New to cybersecurity want to get educated on fundamental content before signing up?

Check out Cyberversity - our free resource library covering essential cybersecurity topics.

Learn more