Online Workshop Hands-on Lab OWASP Top 10

Learn to hack. Like a pro.

Practical 2-day workshop: penetration testing for web applications with Kali Linux, Burp Suite and OWASP Top 10 - online on German servers, without US providers.

2 days / 16 units

Max. 12 participants

30 days lab access

Reserve My Seat View Curriculum

Next date: 22-23 Jun 2026 · Seats available

Learning penetration testing for web applications systematically

In two intensive days you learn the methodology, tools and mindset of professional penetration testers. The workshop combines solid theory with immediately applicable practice - in a safe virtual testing environment where you try out real attack techniques.

Unlike pure theory courses, we focus on learning by doing: every topic is deepened through a practical exercise. You work with Kali Linux and Burp Suite - the standard tools of professional penetration testers. Our trainers are active security consultants with OSCP certification and experience from hundreds of penetration tests.

Why should you learn pentesting?

The ability to think like an attacker is the best foundation for effective defence. Whether you administer systems, develop software or are responsible for IT security - those who can find vulnerabilities themselves prevent others from exploiting them. According to BSI threat reports, more than 70 new vulnerabilities are published daily. Many of them affect web applications.

Your benefits

Understand the attacker's perspective: Learn how hackers analyse web applications and identify vulnerabilities
Hands-on experience: Work with Kali Linux, Burp Suite, Nmap, SQLMap and Hashcat in a realistic environment
OWASP Top 10 in practice: Each of the Top 10 vulnerabilities is not just explained but actively exploited
Safe lab environment: All exercises in an isolated cloud environment - no risk to real systems
Small groups: Max. 12 participants for individual coaching and expert discussions
30 days lab access: After the workshop you can continue practising and deepen what you've learned for 30 days
Career foundation: Ideal entry point for CTFs, Hack-the-Box challenges and the path to OSCP certification

The Lab Environment

Each participant receives their own fully pre-configured environment in the cloud:

Attacker system: Kali Linux with pre-installed tools (Burp Suite, Nmap, SQLMap, Hashcat, DirBuster, etc.)
Target systems: Multiple intentionally vulnerable web applications with realistic scenarios
Access: Via browser - no installation on your machine required
Post-workshop access: 30 days lab access for independent practice after the workshop

Curriculum

Day 1 - Fundamentals, Reconnaissance & Web Proxy

Morning (09:00-12:30)

Lab environment orientation: Kali Linux, terminal basics, network setup
Ethical and legal foundations: legal framework (§202a-c StGB / computer crime laws), authorisation, responsible use
Hacking fundamentals: how do attackers think? Kill chain, phases of a penetration test
Core concepts: CVE, CVSS, exploit, payload, reverse shell, privilege escalation
HTTP fundamentals: request/response, headers, cookies, sessions, REST APIs
Hands-on: Getting to know Kali Linux - first commands and tool orientation

Afternoon (13:30-17:00)

Reconnaissance: passive vs. active information gathering
OSINT techniques: Google Dorks, Shodan, WHOIS, DNS enumeration, subdomain discovery
Nmap: port scanning, service detection, NSE scripts for vulnerability scanning
Web proxy fundamentals: intercepting and analysing HTTP traffic
Browser developer tools as a security tool: DOM inspection, cookie manipulation, console
Hands-on: Setting up Burp Suite, intercepting and analysing HTTP traffic of a target site
Challenge: Reconnaissance task - find all information about the target system

Day 2 - OWASP Top 10, Exploitation & Reporting

Morning (09:00-12:30)

OWASP Top 10 overview: the most common vulnerabilities in web applications
SQL Injection: types (error-based, blind, time-based), detection and exploitation with SQLMap
Cross-Site Scripting (XSS): reflected, stored, DOM-based - payloads and impact
Broken Authentication: session hijacking, credential stuffing, token manipulation
IDOR and Broken Access Control: privilege escalation at application level
Hands-on: Practising SQL injection and XSS on the vulnerable target application

Afternoon (13:30-17:00)

Password cracking: brute force, dictionary attacks, rainbow tables, Hashcat in practice
Social engineering: phishing fundamentals, pretexting, baiting - detection and defence
File upload vulnerabilities: web shells, bypassing upload filters
Server-Side Request Forgery (SSRF) and XML External Entities (XXE)
Reporting: how to document findings professionally? CVSS scoring, remediation recommendations
Final Challenge: Capture the Flag - find all flags in the target environment
Further resources: HackTheBox, TryHackMe, OSCP preparation, bug bounty programmes

Who is this workshop for?

The workshop is aimed at anyone who wants to learn penetration testing for web applications from the ground up. Particularly suitable for:

›System and network administrators - who want to understand how attackers compromise their systems
›Developers and DevOps engineers - who want to write secure software and avoid common vulnerabilities
›IT security officers - who need a practical understanding of technical security assessments
›IT managers and team leads - who must evaluate and prioritise pentesting results
›Career changers - pursuing a career in IT security who want a hands-on entry point
›Students - of computer science, IT security or related fields seeking practical experience
›CTF enthusiasts - who want to build skills systematically and learn professional methodology

Prerequisites

›Recommended: Basic networking knowledge (IP addresses, HTTP, DNS, ports)
›Helpful: Command line experience (Linux or Windows terminal)
›Not required: Prior knowledge of IT security, pentesting or programming
›Your own computer with stable internet connection (lab is fully cloud-based)
›Current browser (Chrome, Firefox or Edge) - no additional software installation required

Certificate & Career Paths

After successful participation you receive the AWARE7 Participation Certificate "Penetration Testing for Web Applications", confirming your acquired skills in:

›Reconnaissance and information gathering (OSINT, Nmap, DNS enumeration)
›Web application security testing per OWASP Top 10
›Exploitation with Burp Suite, SQLMap and Kali Linux
›Password cracking and credential attacks
›Social engineering: methods and detection
›Professional reporting of security findings

Career Paths in Pentesting

›OSCP (Offensive Security Certified Professional) - the reference certification for pentesters. This workshop provides the foundations you need for OSCP preparation.
›CEH (Certified Ethical Hacker) - widely recognised certification focusing on methodology and tools
›BSCP (Burp Suite Certified Practitioner) - specialisation in web application testing
›Bug Bounty Hunter - earn money finding vulnerabilities for companies like Google, Meta or Microsoft
›T.I.S.P. - TeleTrusT Information Security Professional for a broader security career

After the Workshop

›30 days lab access for independent continued practice
›Recommended learning paths and resources for further development
›Access to our alumni community for professional exchange
›10% discount on follow-up courses at AWARE7

Upcoming Dates

22-23 Jun 2026

Online

Available

07-08 Sep 2026

Online

Available

23-24 Nov 2026

Online

Available

Reserve Seat

Frequently Asked Questions

Who is this workshop suitable for?

The workshop is aimed at system and network administrators, IT security officers, developers, DevOps engineers and career changers who want to acquire fundamental penetration testing skills. Developers who want to understand how attackers target their applications - and how to prevent it - benefit especially. No prior knowledge of IT security or pentesting is required.

Do I need prior knowledge?

Basic networking knowledge (IP addresses, HTTP, DNS) is recommended. Experience in IT security, pentesting or programming is not required - the workshop is designed as an entry point and builds systematically. If you can operate a browser and a terminal, you can participate.

Which tools are used?

You work with Kali Linux as the base operating system and industry-standard tools: Burp Suite (web proxy and scanner), Nmap (network scanner), SQLMap (SQL injection tool), Hashcat (password cracking), OWASP ZAP and more. All tools are pre-installed in the provided virtual testing environment - you do not need to configure anything yourself.

What do I receive as a participant?

Two full days of online live training with experienced penetration testers, access to a professional virtual lab environment with prepared scenarios, an AWARE7 participation certificate, all training materials as PDF, a web application pentesting checklist, and 30 days of lab access after the workshop for continued practice.

How does the online workshop work technically?

The workshop runs exclusively on a GDPR-compliant platform on German servers - without Zoom, Teams or other US-based providers. The lab environment is browser-based and requires no installation. You work in real time with the trainer and other participants via video, audio and chat. For group bookings of 5 or more, we can customise content and lab scenarios to your infrastructure.

Is this workshop legal? Am I allowed to hack?

In the workshop you work exclusively in a safe, isolated virtual testing environment - no real systems are attacked. The legal framework (German §202a-c StGB, equivalent to CFAA/Computer Fraud regulations) is covered in detail on the first day. Professional pentesting is always authorised and contractually regulated. You learn the ethical and legal principles that responsible use of security knowledge requires.

Does the workshop prepare me for OSCP?

The workshop covers fundamental methodology and tools that are also relevant in the OSCP exam: reconnaissance, exploitation, privilege escalation, report writing. However, it is not an OSCP preparation course - that would require significantly more extensive training. The workshop is ideal as an entry point to check whether pentesting is the right career path for you.

How does the lab environment work?

The lab runs in the cloud and is accessible through your browser - no installation on your machine required. You get access to a fully pre-configured Kali Linux instance and several intentionally vulnerable web applications (targets). The environment is individually provisioned for each participant so you can work at your own pace.

What makes this workshop different from free online courses?

Three things: first, live interaction with experienced penetration testers who answer questions in real time and provide individual guidance. Second, a professional lab environment with realistic scenarios from our consulting practice - not generic tutorials. Third, small group size (max. 12) ensuring nobody gets left behind. Free courses offer good content but not a comparable learning experience.

Your Trainers

Active penetration testers with OSCP certification and experience from hundreds of security assessments. Not theoretical textbook knowledge, but practical experience from real engagements.

Vincent Heinen

Head of Offensive Services

E-Mail

PGP 1DDAA57F2B972787

M.Sc. in IT Security with more than 5 years of experience in offensive security analysis. Leads the delivery of penetration tests, specializing in web applications, network infrastructure, reverse engineering and hardware security. Responsible for several responsible disclosures.

Responsible Disclosures: CVE-2023-0865 CVE-2025-43579 CVE-2025-53533

OSCP+ OSCP OSWP OSWA

Vollständiges Profil ansehen

Aus dem Blog