Roadmaps Security roadmaps Offensive security and assessment
Assess web applications and APIs for security flaws under authorisation: the OWASP methodology, REST, GraphQL and WebSocket testing, and reports developers can act on.
Estimated time: 12–24 months · At about 10 hours a week.
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Test only what you are permitted to: your own apps, practice apps, or a target explicitly in a bug bounty or engagement scope. Understand the law first.
Requests, responses, headers, cookies, CORS and the same-origin policy. Most web flaws live in the details of how these work.
Learn safely on apps built to be attacked, such as Juice Shop and WebGoat, in a local lab. They teach the issues without breaking the law.
The industry reference for the most critical web risks. Learn each category, how to find it and how it is fixed.
A proxy such as Burp or ZAP lets you see and modify requests. It is the core tool of web testing; learn it well.
The OWASP WSTG gives a structured checklist from information gathering to business logic. Methodology stops you missing whole classes of issue.
SQL, command and other injection let untrusted input change what a system does. Learn to find, verify and explain them, and the parameterised fixes.
XSS runs attacker script in a victim's browser. Learn the types, where it hides, and how output encoding and CSP prevent it.
The most common serious finding: users reaching data or actions they should not. Test every object and action against every role.
Weak login, session handling, password reset and multi-factor flaws. Learn to test them and the standards that fix them.
Tricking a server or a user's browser into making unintended requests. Learn how each works and the defences such as tokens and allowlists.
Abusing the intended workflow: skipping steps, tampering with prices, replaying actions. Tools cannot find these; understanding the app can.
APIs expose the same risks plus their own: object-level authorisation, mass assignment and excessive data exposure. The OWASP API Top 10 maps them.
GraphQL's flexibility brings introspection, nested-query abuse and authorisation gaps. Learn how to test it and how to lock it down.
Persistent connections need their own authentication, authorisation and input handling. Learn to test them with the right tooling.
Modern apps delegate auth to OAuth and OpenID Connect. Learn the flows and the common implementation mistakes that break them.
Single-page apps push logic to the browser, adding DOM XSS, client-side access control and dependency risks. Test the front end as well as the API.
Write findings developers can act on: clear reproduction, impact, severity and a concrete fix. The goal is fixed code, not a long report.
Bug bounties let you test real systems legally, within each programme's scope and rules. Read the scope carefully and always stay inside it.
The best testers chain small issues into serious impact and understand frameworks deeply. Keep learning from write-ups and disclosed reports.
Automate reconnaissance and repetitive checks so you spend human time on logic. Build or adapt tooling responsibly, within scope.
Web applications and APIs are the most exposed part of most organisations and the most common way in. Web and API security testing assesses them, with authorisation, against a structured methodology, to find flaws before attackers do and help developers fix them.
This roadmap is a learning path for authorised and professional testing. It leans on the OWASP testing guides, uses deliberately vulnerable practice apps, and focuses on verifying real issues and writing useful reports. Test only your own applications, purpose-built practice apps, or targets in a bug bounty or engagement scope.
Almost every organisation runs web apps and APIs, and almost all have flaws. Skilled testers who understand modern app and API design and can explain issues to developers are in high demand, in consultancies, in-house teams and bug bounty programmes.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact