Learn web application hacking from the attacker POV

Attacks on web applications are very common. (Image source: 123RF)

---

Web applications are the face of the digital era. Software installed on a specific machine is now the exception; most digital work runs through web applications, and they attract a lot of criminal attention.

Attacks on web applications are very common. Daily malicious web-application and API transactions can reach tens of thousands of attempts. These risks put pressure on security experts, systems architects, developers and many other technically focused professionals to find the flaws that expose their applications and users to harm.

Thinking like an attacker is one of the best ways to scrutinise security. A new two-day course from penetration testing experts at SensePost Training teaches these techniques and how to think about countering them.

The Web Application Hacking course (6 and 7 October 2026) provides both theoretical and practical exposure to the methods and thinking that subvert a web application's security. Taught by veteran penetration testers and dedicated security specialists from SensePost Training and Orange Cyberdefense, this high-impact course delivers a practical foundation to a wide range of technical professionals.

"We designed our Web Application Hacking course to give IT professionals a solid foundation in web application security. They can use this knowledge to start a pen-testing career, apply security thinking in development, software architecture or server administration, and understand the underlying concepts when managing application teams and environments. Over the two days, they will move from beginner to expert knowledge, reinforced by extensive practical work in dedicated virtual lab environments," says Willem Steynberg, Head of Training for SensePost.

SensePost Training's Web Application Hacking course is based on real-world security experiences. It continues 20+ years of training experience, including courses presented at major conferences such as Black Hat and DefCon.

Over the two-day course, eight hours each day, course students will learn about web application security from the attacker's vantage across 16 main modules and multiple sub modules as follows, including:

• HTTP basics, GET and POST requests, and intercepting proxies
• Cookie and session fundamentals, and cookie manipulation
• Web vulnerabilities, including the OWASP Top 10
• Bypassing server- and client-side controls
• Identifying and exploiting broken authorisation and authentication controls
• Discovering and guessing login and other user details (enumeration)
• Accessing users objects via direct object reference vulnerabilities
• Finding and exploiting local file inclusion vulnerabilities
• Injections, cross-site scripting attacks, request forgeries and more

Fully cloud-hosted, participants just need a laptop, browser and internet access.

A blend of detailed theory and intensive practical work will galvanise the knowledge, presented live by trainers via Microsoft Teams. Students will engage directly with the trainers during the training session, and via e-mail afterwards.

An online course portal provides course materials, and students can use their individual dedicated virtual lab to practice their knowledge. On completing the course, they will have additional access to the online lab and portal for two weeks. They can also apply to convert their time into continuing professional development (CPD) points or other enterprise learning verifications.

Offence is often the best defence. Step into the shoes of attackers and understand how they size up a web application, its components and environment.

Whether someone wants to expand their career into security testing or have a solid grasp on web application security for development, architecting or leadership, the SensePost Training Web Application Hacking course is an intensive, highly valuable two-day engagement that puts participants two steps ahead of adversaries. Technology veterans are welcome and students can qualify for a discount.

Find out more at https://www.orangecyberdefense.com/global/insights/events/levelup-2026, book your seat for 6-7 October 2026, and step up your knowledge of web application security.