Core Web Application Security Testing

About this course

This course features Coursera Coach! A smarter way to learn with interactive, real-time conversations that help you test your knowledge, challenge assumptions, and deepen your understanding as you progress through the course. Take your web application security skills to the next level by exploring common vulnerabilities that affect modern websites and learning how security professionals assess them in controlled environments. Through practical demonstrations and hands-on labs, you'll develop the ability to identify, analyze, and understand exploitation techniques while strengthening your knowledge of secure web application testing. The course begins with PHP code injection and file upload vulnerabilities before progressing to OS command injection and Server Side Include (SSI) attacks. You'll configure tools such as Foxy Proxy and Commix while learning to investigate server-side weaknesses responsibly. You'll then examine directory traversal vulnerabilities using Dotdotpwn and understand how attackers access unauthorized files through insecure application design. As you advance, you'll explore Cross-Site Scripting (XSS), broken access control, Insecure Direct Object References (IDOR), Cross-Site Request Forgery (CSRF), and brute force attacks using realistic lab environments and industry-standard tools. The course concludes with an SQL crash course, covering database fundamentals, queries, filtering, and advanced techniques that prepare you for understanding SQL-related security testing in later learning. This course is designed for aspiring penetration testers, cybersecurity students, IT professionals, developers, and ethical hackers seeking practical web security experience. Learners should have a basic understanding of networking, Linux, and introductory web technologies. The course is Intermediate level. By the end of the course, you will be able to identify and assess common web application vulnerabilities, configure security testing tools, evaluate authentication and authorization flaws, understand SQL fundamentals, and perform structured web application security assessments within authorized testing environments.