Offensive Security & Penetration Testing · 90–150 min

Run one tiny authorized web-security assessment

Experience penetration testing as scope, hypotheses, minimal proof, reporting and remediation—not a race to run the most tools.

01 · Setup

What you need

Basic HTTP and one deliberately vulnerable beginner lab from PortSwigger Web Security Academy. The lab is the entire authorized scope; do not probe any public, campus or employer system.

You may stop when the timebox ends. An incomplete result is still useful evidence.

02 · Task

01
Write a one-page rules-of-engagement note: target lab, objective, allowed account/data, excluded actions, stop condition and evidence-storage rule.
02
Read the relevant versioned OWASP WSTG section and draw the lab's visible input, trust boundary and protected action before testing.
03
Write three test hypotheses. Execute only the smallest harmless request needed to validate one; stop when behavior leaves the lab scope.
04
Capture the exact request and response, explain the underlying control failure and separate observed impact from possible impact.
05
Write one finding with scope, evidence, severity reasoning, remediation and a retest case. Compare it with the lab explanation only after finishing your own report.

03 · Pay attention

Was understanding the mechanism more satisfying than copying the payload?
Could a developer reproduce the finding and know what to fix without receiving unnecessary sensitive data?
Did strict scope improve your reasoning, or did you mainly want freedom to attack something else?

Plot twist

Difficulty does not mean the career is a bad fit. The useful question is whether curiosity returned after the difficulty.

04 · Reflect

Would you voluntarily spend another five hours on this kind of problem? Why?

Which part gave you energy, and which part drained it?

What evidence—not a salary video—would you gather before choosing this path?

This site does not save your answers. Put them in your own notebook if useful.

05 · Where to go next