Course overview
The Application Security Professional course teaches you to find and fix the vulnerabilities that live in web applications and APIs. It works through the OWASP Top 10 with real code and real requests, covers authentication, session management and access control failures in depth, and shows you how to write a vulnerability report that a development team can actually act on. The course is aimed at people who already write or test code and want to do so more safely.
Who this course is for
This course is designed for the following groups. If you are not sure whether you fit, ask us — a short conversation is more useful than a longer guess.
- Web and backend developers who want to write safer code
- QA engineers moving into security testing
- Security analysts who want to specialise in application security
- Technical leads responsible for the security of a web application
- Bug bounty hunters who want a structured methodology
What you will learn
- The OWASP Top 10 explained through real vulnerable code, not slides
- How to test for injection, broken access control and authentication flaws
- Session management, cookies, tokens and the mistakes that break them
- Common API security issues, including broken object-level authorisation
- Secure code review: what to look for in a pull request
- Using Burp Suite Community and OWASP ZAP for structured testing
- Writing vulnerability reports that get fixed rather than argued about
- The secure development practices that prevent whole classes of bugs
Curriculum
The course is taught in the module order below. Each module mixes explanation with hands-on work before moving on to the next.
- Application Security Foundations
- API Security
- HTTP & Application Mapping
- File Upload & Business Logic Security
- Authentication Security
- Modern Application Security
- Access Control & Authorization
- Cloud & Application Security
- Injection Vulnerabilities
- Professional Pentesting Methodology
- Cross-Site Vulnerabilities
- Reporting & Capstone
Tools and technologies
Everything used in the course is either free, open source, or available on a free tier suitable for learning. You will install and configure each of these during the course, not just watch someone else use them.
- Burp Suite Community Edition
- OWASP ZAP
- Browser developer tools
- Postman or Insomnia for API testing
- A deliberately vulnerable web application for practice
- Git and a code editor for secure code review exercises
Prerequisites
We would rather you arrive prepared than arrive surprised. These are the things you should already be comfortable with before the first session.
- Basic understanding of how the web works — HTTP, requests and responses
- Some experience writing code, in any language
- Familiarity with HTML and JavaScript at a reading level
- Comfort with browser developer tools
Hands-on labs, CTFs and projects
Most of the course is spent on machines. The work below is what turns each topic from something you have read about into something you can actually do.
- Exploit and then fix each of the OWASP Top 10 categories in a lab application
- Build and use a Burp Suite workflow from proxy setup through to repeatable tests
- Review a real pull request and document the security issues you find
- Test a small API for broken object-level authorisation and injection
- Write a full vulnerability report for a chosen finding, from proof of concept to remediation advice
Learning outcomes
When you finish this course, these are the things you should be able to do without looking them up. Anything you cannot yet do, the trainer will help you with during the final project review.
- Identify and reproduce the vulnerabilities in the OWASP Top 10
- Test a web application systematically rather than by guessing
- Review source code for common security mistakes
- Assess an API for authentication and authorisation weaknesses
- Write a clear, actionable vulnerability report
- Recommend fixes that developers can actually implement
Career paths
This course supports the roles below. We do not make placement claims or guarantee outcomes — what you do with the skills is up to you — but these are the job titles that most often ask for what this course teaches.
- Application security engineer
- Security-focused developer
- Penetration tester (web application specialisation)
- Security code reviewer
- QA engineer with security responsibilities
Frequently asked questions
You need to be able to read code, but you do not need to be a working developer. QA engineers, technical support staff and security analysts with some programming exposure do well on this course. If you have never written code at all, start with our Python Development Professional course first.
The security concepts apply across languages. The lab code and the secure code review exercises are primarily in PHP, JavaScript and Python because those are the languages our students most commonly meet in the wild. The methodology you learn transfers directly to Java, .NET, Go and anything else you work with.
Both, and deliberately so. You cannot fix a vulnerability you cannot find or prove, so the course teaches you to reproduce issues the way an attacker would. The second half of every topic is about the fix — the code change, the framework setting or the design decision that prevents the whole class of bug.
It provides the structured methodology and reporting discipline that bug bounty work depends on. It is not a bug bounty course — we do not coach on specific bounty platforms or on hunting techniques tuned to particular targets. What you will get is a repeatable way to approach a web application that stands up to real-world testing.
