The Web Application Hacker's Handbook, 2nd Edition
by Dafydd Stuttard, Marcus Pinto · Wiley
Stuttard and Pinto's 900-page methodology for attacking web applications: mapping, bypassing client-side controls, authentication and session flaws, access control, injection, logic bugs, and a step-by-step testing checklist. Written by Burp Suite's creator.
This link may earn us a small commission at no extra cost to you. Affiliate disclosure
More resources on Ethical Hacking
OWASP Foundation
Nonprofit foundation publishing open web application security standards and guides, including the OWASP Top Ten, the Application Security Verification Standard, the Web Security Testing Guide and the Cheat Sheet Series, used to identify, test for and prevent common web vulnerabilities.
tryhackme.com
TryHackMe is an online cybersecurity training platform offering hands-on labs, guided learning paths, and real-world scenarios (rooms and challenges) to practice penetration testing, web security, and network defense in an interactive, gamified environment.
NetworkChuck - Ethical Hacking Full Course
First half of TCM Security's free 2023 Practical Ethical Hacking course on YouTube, taught by Heath Adams: networking and Linux refreshers, Python basics, information gathering, scanning and enumeration, and exploitation of a first vulnerable machine. Part 2 continues into Active Directory.
Practical Ethical Hacking
Practitioner video course on network penetration testing, covering reconnaissance, scanning and enumeration, exploitation, Active Directory attacks, post-exploitation, web application basics and report writing using Kali Linux. Learners finish able to run a small internal pentest in a lab and document findings for a client.
VulnHub
Community-maintained catalogue of downloadable, intentionally vulnerable virtual machines you run locally in VirtualBox or VMware. Working through boxes teaches enumeration, exploitation, and privilege escalation end to end, and most have public walkthroughs to check your approach against.
HackTheBox Academy
Hack The Box's structured, module-based learning platform, separate from its labs. Modules pair written theory with browser-based target machines and end in graded skills assessments; job-role paths lead to the CPTS and CBBH certifications. Fundamentals tier is free, most modules cost cubes.