Updated in May 2025.

This course now features Coursera Coach! A smarter way to learn with interactive, real-time conversations that help you test your knowledge, challenge assumptions, and deepen your understanding as you progress through the course. Unlock the world of web application penetration testing with this hands-on course designed to provide practical expertise in identifying and exploiting vulnerabilities in web apps. Learn foundational web basics, including the anatomy of URLs, HTTP methods, and the critical infrastructure behind web applications. Explore databases, APIs, and CMS platforms to develop a robust understanding of how modern web apps function. As you progress, dive deep into the essential tools of the trade, from web browsers to advanced frameworks like Burp Suite, OWASP ZAP, and SQLMap. Gain mastery over a comprehensive toolkit used by industry professionals for reconnaissance and attack planning. Learn to perform manual inspections, vulnerability scans, and directory fuzzing to uncover hidden security flaws. The course culminates in an extensive exploration of attack techniques. From Cross-Site Scripting (XSS) and SQL Injection (SQLi) to CSRF, SSRF, and Command Injection, you’ll gain practical skills to identify, test, and verify various vulnerabilities. Each attack scenario is explained with real-world relevance and practical examples to strengthen your learning. Designed for security enthusiasts, IT professionals, and developers, this course requires a basic understanding of programming and networking. Whether you're a beginner looking to enter the cybersecurity field or an intermediate learner aiming to upskill, this course offers valuable insights at every step.