Description

A focused course, tailored for you

The Associate Appsec Consultant's Web and API Pentest Workbook

A structured 12-module path from running scanner output to writing the finding chapter the senior consultant signs off on the first read.

Your scanner finds the IDOR. Your senior rewrites your finding chapter. Twelve modules that close the gap between the two so the senior signs your report on the first read.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Associate-level appsec work in a small consulting shop has a clear rhythm. You scope the engagement, you stand up the proxy, you walk the OWASP top ten on the web app, you fuzz the JSON and the GraphQL endpoints, you find the broken object-level authorisation, the missing rate limit on the OTP flow, the JWT signed with the none algorithm or with a weak secret, the SSRF on the avatar uploader, the open S3 bucket the front-end happens to hit, and you write it all up in the company template. The technical work is sound. What slows the engagement down is the chapter craft around each finding. The senior consultant who reviews your draft rewrites the impact paragraph because it speaks to a teammate rather than to the application owner. The reproduction steps assume the reviewer has your exact session cookie and your exact test account. The remediation says 'sanitise input' instead of naming the library, the version, the configuration flag and the unit test that proves the fix. The retest pack is missing the screenshot that shows the request returning a 403 after the fix, so the client opens a fresh ticket asking for evidence. Each round of rework eats a billable day. The work this workbook teaches is the chapter craft, the triage discipline and the retest hygiene that lets a senior approve your report on the first read so you move from running scanner queues to owning engagements end to end.

What you walk away with

Write a finding chapter the senior consultant signs off on the first read, with impact, reproduction, remediation and references each in the pattern reviewers expect.
Run a structured manual web plus API test plan that goes past scanner output, with worked examples for IDOR, broken authentication, server-side request forgery, JWT and OAuth abuse, GraphQL introspection abuse and rate-limit bypass.
Triage a noisy scanner queue down to the findings the application owner will actually pay to fix, with a defensible severity rationale per finding.
Run a clean scoping call with the application owner that captures account matrix, environment, out-of-scope assets and rules of engagement on a one-page artefact.
Run a retest cycle that closes the engagement without a follow-up ticket, with the evidence pack the client's auditor expects.

The 12 modules

Module 1. Engagement kick-off and the one-page scoping artefact

The kick-off call where the senior consultant lets you lead. Questions about authentication flows, multi-tenancy, payment integrations, third-party APIs, regulatory scope. The one-page artefact capturing account matrix, environment, out-of-scope assets, rules of engagement, contact tree, dates and agreed report format. Worked example for a mid-size SaaS engagement with a customer portal, internal admin app and partner-facing REST API.

Module 2. Setting up the test environment without slowing the client down

Burp Suite configuration, proxy and certificate handling for native and mobile clients, account matrix provisioning, request-rate throttles agreed with the client to avoid taking the staging environment down, evidence-folder structure that survives the engagement and is retrievable months later for the retest. Worked example covering the day-one mistake of running the scanner full-throttle on an environment the client also uses for QA and the conversation that follows. The hygiene that prevents that conversation.

Module 3. The manual web test plan past the scanner

Where the automated scanner stops and manual work begins. Walkthroughs for broken object-level authorisation on user-id parameters, broken function-level authorisation on admin-only endpoints, business logic abuse in checkout flows, second-order injection in audit log fields, file upload abuse, SSRF on URL-fetching features. The worked artefact is a fillable manual test plan tied to the OWASP web testing guide that the senior reads as evidence of coverage.

Module 4. The API test plan for REST, JSON, GraphQL

The API security top ten as a worked test plan rather than a checklist. Broken authentication on JWT-secured endpoints, weak HMAC secrets, none-algorithm acceptance, JWK URL spoofing. Broken authorisation on object IDs, mass assignment on PATCH endpoints, GraphQL introspection abuse, GraphQL alias and batch abuse for rate-limit bypass. The worked artefact is an API test matrix with one row per endpoint family.

Module 5. Authentication and session abuse end to end

OAuth 2 authorisation code flow misconfigurations, redirect URI abuse, PKCE absence on public clients, refresh token rotation gaps, single-sign-on assertion replay. Session fixation, session pinning, cookie scoping mistakes, cross-site request forgery on JSON endpoints, CORS misconfigurations that effectively defeat the same-origin policy. The worked artefact is a finding chapter on an OAuth flow that accepts an attacker-controlled redirect URI and the exact remediation language the application's identity team can act on.

Module 6. Server-side request forgery, deserialisation, injection at depth

SSRF detection where the response is blind, with the out-of-band callback infrastructure to confirm. Cloud metadata endpoint abuse on AWS, GCP, Azure with the actual paths and expected responses. Deserialisation abuse on Java and dotnet stacks where the application accepts serialised payloads. Second-order SQL injection past parameterised queries, NoSQL injection on MongoDB query operators. The worked artefact is a finding chapter on an SSRF that pivots into cloud-credential exfiltration and the conversation with the application owner who initially dismisses it.

Module 7. Triaging the scanner queue and writing the severity rationale

What to do with the hundred-plus findings the automated scanner produces on a real-world web application. The triage rubric separating noise from findings worth a chapter. The severity rationale pattern using the CVSS vector as the spine but writing business impact in plain language. The worked artefact is a triage spreadsheet on a real scanner export and the resulting short list of nine findings worth chapter treatment.

Module 8. The finding chapter pattern the senior signs off on the first read

The structure: title, severity with vector, two-sentence executive summary, technical detail for the application owner, reproduction steps that survive a different test account, remediation naming the library, version, configuration flag and unit test, references to OWASP and CWE. The voice: written for the application owner fixing it on a sprint deadline, not for a teammate. The worked artefact is a single finding chapter approved by the senior without rewriting any section.

Module 9. Evidence capture that survives review

What to screenshot, what to record as a HAR file, what to keep as a step-by-step replay so the retest cycle three weeks later can reconstruct the finding from a fresh test account. Redacting customer data before the report leaves your laptop. The evidence-pack folder structure where the senior and the client's auditor both find what they expect. Worked example for an SSRF retest that initially had only a single screenshot.

Module 10. The client debrief and defending findings live

The hour-long debrief call where the application owner pushes back on three findings as 'not a real issue' or 'compensating controls handle it'. The response that acknowledges the compensating control, demonstrates the residual risk in plain language, and either accepts the risk in writing or holds the finding open. Artefact: a debrief deck for an engagement with twenty-two findings including the three contested.

Module 11. The retest cycle that closes cleanly

The retest engagement two to four weeks after the original. Clean re-provisioning of test accounts, the per-finding evidence pack proving the fix landed, the language for findings that were partially fixed or that introduced new findings, the closing letter the client's auditor signs off as evidence of remediation. Worked example for a retest closing eighteen of twenty-two findings with the exact wording for each category.

Module 12. Moving from associate to consultant on the next engagement

The conversation with your principal about being named consultant on the next scoping call. The redacted portfolio artefacts from prior engagements that demonstrate chapter quality, debrief defence and retest hygiene. The specific reading and lab work that closes the gap between associate and consultant. Worked artefact: a one-page memo proposing you lead the scoping call on the next mid-size engagement, with the explicit ask for sign-off.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

You are the associate consultant on a mid-size SaaS engagement and the senior is in another timezone for the kick-off call.

You ran the scanner and it returned 134 findings on the web app and 86 on the API. The senior asked which ones are real before lunch.

Your draft report came back with seventeen tracked-changes comments. Each one is about chapter craft, not technical accuracy.

The client pushed back on three findings on the debrief call. Your principal is on the call but is waiting for you to defend them.

What you get with this course

Twelve written modules covering the full engagement lifecycle from scoping to retest sign-off.
A worked example artefact per module: scoping checklist, account-matrix template, manual test plan, API test matrix, finding-chapter pattern, debrief deck, retest evidence pack, principal-memo template.
Reference set covering OWASP web testing guide, OWASP API security top ten, CWE references and CVSS vector worksheets aligned to each module.
A hand-built implementation playbook tailored to the web and API stack you most often test against, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours of purchase, the learning environment account is provisioned and the implementation playbook tailored to your stack is delivered alongside it.

Modules 1 to 4 in week one cover scoping, environment setup, manual web test plan and API test plan.

Modules 5 to 8 in week two cover authentication, SSRF and injection at depth, scanner triage and the finding-chapter pattern.

Modules 9 to 12 in week three cover evidence capture, client debrief, retest cycle and the principal-memo conversation.

Before and after

Before

You run the scanner, write up the findings in the company template, and the senior consultant rewrites your draft. The next engagement starts with the senior leading the kick-off again because last time's report needed too much rework.

After

You run a structured manual test plan past the scanner, write finding chapters the senior signs off on the first read, defend the contested findings live on the debrief, close the retest without a follow-up ticket, and your principal names you lead on the next engagement.

What happens if you do not address this

Without chapter craft and triage discipline, the rework cycle stays the same. Two more years of running scanner queues while peers who write reports the senior approves get named on engagements and move into consultant pay bands. The technical knowledge does not by itself unlock the next role; the chapter craft does.

Who it is for

The associate or junior consultant in a small to mid-size appsec or offensive-security firm who runs web application and API penetration tests on customer environments. You are comfortable in Burp Suite, you can chain a few manual exploits past the scanner output, you know your OWASP top ten and your API security top ten well enough to find the obvious bugs, and you write your findings into the company's report template. You want to move from 'the associate who runs the scan' to 'the consultant who owns the engagement' inside the next twelve to eighteen months, which means writing reports that senior reviewers do not rewrite, scoping kick-off calls without a senior in the room, defending findings on the client debrief, and being the named consultant on a retest engagement.

Who this is NOT for. Not for application developers learning secure coding for the first time, not for red team operators focused on internal network compromise and lateral movement, not for SOC analysts running detection-and-response work, not for senior consultants who already own engagements end to end. Not a CEH or OSCP exam prep. Not a bug bounty hunting course.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. About four to six hours per week for three weeks for the structured walk-through, plus the worked artefacts adapted to your next live engagement as it runs.

Why $199 is the right number

OSCP and similar offensive-security certifications focus on exploitation craft but not on report chapters, debrief defence or retest hygiene. Bug bounty platforms reward the finding itself, not the consulting workflow around the finding. Internal mentoring inside a small firm depends on the senior consultant having time, which is usually the bottleneck this workbook is built to remove.

FAQ

How is this different from an OSCP or CEH track?

Exam-style certifications focus on exploitation under lab conditions. This workbook focuses on the consulting workflow around the finding: scoping, chapter craft, debrief, retest. The technical content assumes you are already comfortable with Burp Suite, OWASP top ten and the API security top ten; the time is spent on what happens before and after the exploit.

Do I need to be at a particular size of firm?

No. The workbook is written for associates in small to mid-size appsec firms where the senior consultant is the bottleneck on report sign-off. The artefacts adapt to a Big-4 audit-shop workflow and to a five-person independent appsec consultancy. The worked examples assume web plus API engagements rather than internal network or red team work.

Is there a refund if it does not fit my workflow?

Yes, a thirty-day refund if the workbook does not match what you actually need on your next engagement. The implementation playbook is yours regardless.

What is the implementation playbook?

A hand-built document tailored to the application stack you most often test against, covering the scoping artefact, the manual test plan, the API test matrix, the chapter pattern, the debrief structure and the retest evidence pack for that specific stack. Delivered alongside course access within 24 hours of purchase.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.