About
Prerequisite: Complete [Web Pentesting Fundamentals](https://www.darkrelay.com/challenge-page/web-pentesting-fundamentals) before this module. That unit covers Burp interception on NeonVault, HTTP sessions and cookies, and mapping findings to OWASP Top 10 / WSTG / ASVS. You will need those skills here when you move from recon into exploitation. In this module of the Web Application Pentester learning path, you move from web fundamentals to core vulnerability exploitation against NeonVault. You will bypass authentication with SQL Injection, abuse horizontal IDOR on profiles, steal a session via Stored XSS on support tickets, read sensitive files through path traversal on the download endpoint, and forge a Cross-Site Request Forgery (CSRF) request that changes a trader's notification email. You will execute these attacks manually so you understand the underlying mechanics rather than relying on automated exploitation tools. Every finding maps to the OWASP Top 10 so you can produce report-ready notes. Upon completion of the module, students will be able to: - Identify and exploit SQL Injection to bypass authentication on a login form. - Abuse Broken Access Control to perform Insecure Direct Object References (IDOR). - Plant and trigger Stored XSS to steal a privileged session cookie. - Exploit path traversal on a download endpoint to read local configuration files (LFI-style file disclosure). - Prove CSRF on a cookie-authenticated state-changing email settings endpoint (including unsafe GET mutations). For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry