Web Application Hacking and Security

Web Application Hacking and Security develops practical skills for testing and securing modern web applications and APIs. It covers web architecture, reconnaissance,...

Enquire about this programme Back to catalogue

Web Application SecurityRegistration Open

Programme overview

Web Application Hacking and Security develops practical skills for testing and securing modern web applications and APIs. It covers web architecture, reconnaissance, authentication, sessions, access control, injection, browser attacks, file handling, APIs, business logic, automated testing, secure coding, remediation, and reporting. Participants will practise authorised security testing in controlled environments, moving from planning and discovery to technical validation, evidence capture, risk analysis, and professional reporting.

Programmes can be delivered via

HRD Corp Claimable

Yayasan Peneraju aligned

EC-Council

At a glance

Course code: EC-035
Provider: EC-Council
Category: Web Application Security
Status: Registration Open
Duration: Enquire us
Price: RM 2,950

What participants should gain

Map web application architecture and attack surfaces
Test authentication, sessions, access control, and input handling
Identify injection, browser, API, file, and business-logic vulnerabilities
Use manual and automated web-security testing tools
Recommend remediation and produce professional findings reports

Participant readiness

Knowledge of HTTP, web applications, and basic networking
Experience with web development or ethical hacking is beneficial
Basic command-line and scripting skills are recommended

Who this course is for

Ethical hackers, penetration testers, red-team members, security consultants, and assessors
Network, application, cloud, or security professionals developing offensive-testing capability
Professionals working only within formally authorised and controlled testing environments

How the course is delivered

This programme will be conducted through interactive lectures, demonstrations, guided labs in isolated environments, controlled attack scenarios, evidence collection, group discussions, reporting exercises, and a final practical assessment.

Course outline

Module and topic breakdown

Module 1: Web Application Architecture, HTTP, and Security Fundamentals

Application architecture, HTTP, sessions, APIs, databases, frameworks, and trust boundaries

Module 2: Web Reconnaissance and Attack-Surface Mapping

Domain, DNS, subdomain, hosting, certificate, technology, endpoint, content, and metadata discovery

Module 3: Authentication and Identity Testing

Identity proofing, credential storage, password policy, multifactor authentication, and federation

Module 4: Session Management and Access Control Testing

Session creation, identifiers, cookies, timeouts, renewal, logout, and invalidation

Module 5: Input Validation and Injection Attacks

Allow-list validation, canonicalisation, type, range, length, and format controls

Module 6: Cross-Site Scripting, CSRF, and Browser-Side Attacks

Cross-site request forgery conditions, browser credential behaviour, and state-changing requests

Module 7: File Upload, Path Traversal, and Deserialization

Serialisation formats, object reconstruction, trust boundaries, and application use cases

Module 8: Web Services and API Security Testing

API architecture, endpoints, methods, parameters, objects, tokens, schemas, and trust boundaries

Module 9: Business Logic, Race Conditions, and Advanced Attacks

Application workflows, states, rules, assumptions, roles, limits, and trust decisions

Module 10: Automated Scanning and Manual Validation

Core concepts, terminology, and purpose of Automated Scanning and Manual Validation

Module 11: Secure Coding, Configuration, and Remediation

Secure coding standards, defensive programming, input handling, output encoding, and safe APIs

Module 12: Web Application Penetration Testing and Reporting

Application architecture, HTTP, sessions, APIs, databases, frameworks, and trust boundaries

Assessment and completion

Continuous knowledge checks and facilitator feedback throughout the programme
Completion of guided exercises, scenarios, labs, or case-study activities applicable to the course
Final review or practical activity to confirm understanding of the stated course objectives
Official EC-Council examination and certification requirements depend on the selected training package and current exam version

Availability

This programme has a public intake path. Use the enquiry form below to confirm the next available session or a private cohort.

Programme enquiry

Discuss pricing, delivery, or corporate customisation

Use this form to confirm availability, request pricing clarification, or discuss a private cohort for your organisation.