Core · Web Security

OSWA

OffSec Web Assessor

Learn a repeatable black-box web assessment workflow covering request analysis, common vulnerability classes, exploitation and actionable reporting.

Course overview

Skills with real-world context

Designed around the workflows and decisions practitioners use—not a collection of disconnected tool demonstrations.

Learn a repeatable black-box web assessment workflow covering request analysis, common vulnerability classes, exploitation and actionable reporting. The learning path combines guided concepts, repeatable lab methodology, evidence collection and professional communication.

Web Security Analyst Application Security Tester Junior Penetration Tester

2026 market direction

Web and API attack surfaces continue to expand as organizations ship cloud-native products faster. Testers who can manually validate issues beyond scanner output remain valuable.

Course content

What you will study

A focused six-module roadmap. Exact official syllabus and assessment policies remain subject to OffSec updates.

HTTP & Assessment Setup

Requests, responses and headers

Cookies, sessions and tokens

Proxy configuration

Testing scope and methodology

Application Mapping

Content and endpoint discovery

Parameters and input points

Technology fingerprinting

Authentication flow mapping

Input Vulnerabilities

Injection fundamentals

File path and inclusion issues

Command execution pathways

Validation and encoding bypasses

Identity & Access

Authentication weaknesses

Session handling flaws

Authorization testing

Password reset workflows

Browser & Server Attacks

Cross-site scripting

Cross-site request forgery

File upload weaknesses

Server-side request behavior

Exploitation & Reporting

Manual proof development

Impact validation

Evidence collection

Developer-friendly remediation

Plan your preparation

Audience, prerequisites and exam

Who should attend

Pentesters starting web application testing
Developers moving into application security
QA and security analysts validating web risk

Recommended prerequisites

Basic Linux, networking, HTTP, HTML and scripting knowledge. Familiarity with browser developer tools helps.

Certification assessment

A practical web application assessment and report. Consult the official exam guide for current scope and delivery details.

Learning outcomes

Capabilities you will build

Map a web application attack surface

Use a proxy-led manual testing workflow

Exploit common web vulnerability classes

Produce reproducible findings and remediation advice

Primary curriculum reference: Official OSWA course information . Pricing, exam format and availability should always be confirmed with OffSec.