Explore tracks

Resource

ExternalBeginnerPenetration TestingFeatured

Web Application Testing Starter Pack

Curated entry points for learning common web vulnerabilities and building a safe lab practice routine.

Open resource ↗More in this trackBack to library

Start with intentionally vulnerable applications in isolated environments. Do not test systems you do not own or lack written permission to assess.

OWASP Juice Shop is a modern, intentionally vulnerable app suitable for guided practice. Run it locally or in a disposable lab network.

Practice sequence

  1. Map the application: roles, forms, APIs, and interesting parameters.
  2. Work through common classes: injection, broken access control, XSS, misconfiguration.
  3. Keep a finding log with request/response evidence (redact secrets).
  4. Retest after you think you fixed something in a training fork — confirm the fix.

Pair with methodology

Use the Penetration Testing Methodology Notes resource for scoping and reporting habits even in personal labs. Good notes transfer directly to real engagements later.

webowasplabs

Published 5 Oct 2026. External links open destinations outside CyberCrew — verify them before use in workshops.