Web application penetration testing is a craft: the same classes of weakness — injection, broken access control, misdesigned proxies — keep reappearing on every engagement. This guide indexes Hmmnm’s hands-on web pentest tutorials in the order we’d teach them, each with lab-ready exploitation detail and concrete mitigations.
Foundations
- 10 Essential Tips for Aspiring Ethical Hackers — habits that separate pros from scanners
- Ensuring Robust Security in Login and Registration Systems — auth surface checklist
- API Security: Authorization Flaws Behind Modern Breaches — the #1 bug class today: authz
Injection Classes
- Error-Based SQL Injection: How It Works and How to Stop It — error-based SQL injection end-to-end
- Understanding XSS: A Complete Guide to Cross-Site Scripting Protection — cross-site scripting in depth
- XXE Injection: A Detection and Prevention Guide — XML external entities
- Deep Dive into Server-Side Template Injection (SSTI) — SSTI discovery to RCE
Configuration & Trust Boundaries
- CORS Misconfigurations in Modern Web Apps: How to Find and Fix Them — CORS done wrong
- Request Smuggling Explained: Detection and Mitigation in Depth — smuggling fundamentals
- One Request, Two Interpretations: The HTTP Request Smuggling Problem Hiding Behind Your Proxy — smuggling in the real world, behind proxies
Infrastructure & Specialty Testing
- SSH to VPS Security Pentesting: Scenarios, Tools & Hardening — hardening the servers you test from
- Your Source Code Is Showing: The Exposed .git Mistake We've Found for 10 Years Straight — the .git exposure that never dies
- Don't Crash the Factory: How to Pentest OT Networks Without Halting Production — OT/ICS testing safely
Every tutorial includes detection steps, exploitation detail, and the fix — use this page as your index.
This article is part of the guided learning path Web Application Pentesting — track your progress there.