CWAP · Certified Web App Pentester
Animated attack walkthroughs
Every module, animated frame by frame — with every command you would actually type.
42animations
17modules
556steps
529commands
98mruntime
Each page is a self-contained animation with full media controls: play/pause, rewind (plays backwards), fast-forward at 2×/4×/8×, step forward/back, a draggable timeline, a speed selector and loop. Three panels move together on every frame — what you are doing, what is on the wire right now, and what the target does with it.
Every command appears in a terminal you can copy from, and the sidebar collects all commands in order behind a single copy all button — so each animation doubles as a working playbook. Nothing loads from the network: open them offline, from a USB stick, from anywhere.
Authorized / lab use only. Every payload here is for your own labs, the provided practice platforms, or a target you are explicitly permitted to test. Scope adherence is graded above exploitation — the animations say so, repeatedly, on purpose.
00
Introduction & Exam Strategy
2 animationsExam day, hour by hour
Animated, step-by-step: the plan deadline, the sign-off, the hacking cap, the rest block and the debrief video.
▶ 13 steps⌘ 13 commands⏱ 2:12
The XSS Rat methodology, end to end
Animated, step-by-step: scope → recon → map → probe → confirm → chain → stop → document, on one target.
▶ 14 steps⌘ 14 commands⏱ 2:20
01
OWASP WSTG
2 animationsWorking a WSTG category end to end
Animated, step-by-step: WSTG-ATHZ executed against one target — signal order, credible negatives, a time-boxed partial, and the ID travelling into the finding.
▶ 13 steps⌘ 13 commands⏱ 2:17
Using the WSTG as a test plan, not a book
Animated, step-by-step: turning the OWASP Web Security Testing Guide into a coverage matrix for one real target — applicable, N/A, out, deferred — with every claim backed by a file.
▶ 14 steps⌘ 14 commands⏱ 2:28
02
Pentest Planning
2 animationsWriting the scope before you touch anything
Animated, step-by-step: in and out of scope named explicitly, destructive and data-handling rules, escalation and abort criteria — and the machine-readable scope file you gate every command through.
▶ 12 steps⌘ 12 commands⏱ 2:08
The 90-minute plan that gates the exam
Animated, step-by-step: six blocks against a hard clock — objective, scope, surface, budget, tools and AI, rules of engagement — submitted inside ninety minutes, then sign-off.
▶ 12 steps⌘ 12 commands⏱ 2:07
03
Recon & Mapping
3 animationsRecon 1 — subdomains and attack surface
Animated, step-by-step: passive sources → the scope gate → resolution → live probing → fingerprinting → a ranked attack map.
▶ 13 steps⌘ 13 commands⏱ 2:12
Recon 2 — content and endpoint discovery
Animated, step-by-step: robots and history → soft-404 calibration → filtered fuzzing → recursion → JS and schemas → an endpoint inventory.
▶ 14 steps⌘ 14 commands⏱ 2:22
Recon 3 — authentication, roles and the two-account matrix
Animated, step-by-step: auth flows → two accounts in two jars → sessions and claims → the endpoint × role sweep → the matrix module 04 attacks.
▶ 13 steps⌘ 13 commands⏱ 2:14
04
Broken Access Control
3 animationsAttack 1 — IDOR / BOLA
Animated, step-by-step: two accounts, one swapped identifier, and an object the server never checked you owned.
▶ 14 steps⌘ 13 commands⏱ 2:31
Attack 2 — BFLA & HTTP method tampering
Animated, step-by-step: reaching admin functions as a nobody — forced browsing, verb tampering and path-normalisation bypasses.
▶ 15 steps⌘ 14 commands⏱ 2:42
Attack 3 — Mass assignment & parameter-based access control
Animated, step-by-step: discovering hidden object properties and writing the ones the UI never exposed.
▶ 14 steps⌘ 13 commands⏱ 2:30
05
Cross-Site Scripting
3 animationsAttack 1 — Reflected XSS
Find the context, break the context: from a marker in a search box to an authenticated action in the victim's session.
▶ 15 steps⌘ 14 commands⏱ 2:43
Attack 2 — Stored XSS
Inject once, fire for everyone: marker tracking, surviving the write filter, and a second-order payload that only detonates in a staff browser.
▶ 15 steps⌘ 14 commands⏱ 2:45
Attack 3 — DOM XSS
Source to sink: reading the JavaScript, tracing the flow in DevTools, and executing a payload that never touches the server.
▶ 15 steps⌘ 14 commands⏱ 2:43
06
Blind XSS
2 animationsBlind XSS — The callback fires, now what
Animated, step-by-step: a callback lands hours later from an internal admin panel — correlate it, read what it tells you, prove impact, and stay strictly in scope.
▶ 12 steps⌘ 11 commands⏱ 2:00
Blind XSS — Standing up the listener and spraying every input
Animated, step-by-step: build the out-of-band collector, forge a tagged remote-loader payload, and seed every field, header and filename the app will store.
▶ 13 steps⌘ 12 commands⏱ 2:09
07
CSRF
3 animationsCSRF — JSON endpoints, Content-Type tricks and SameSite
Animated, step-by-step: why a JSON API looks CSRF-proof and when it isn't — text/plain coercion, the padded-JSON trick, simple-request rules, and the real SameSite=Lax nuances.
▶ 12 steps⌘ 11 commands⏱ 2:03
CSRF — Classic POST, from candidate to working PoC
Animated, step-by-step: find a state-changing POST with no token, confirm the cookie rides cross-site, build the auto-submitting form, and prove the change happened as the victim.
▶ 12 steps⌘ 11 commands⏱ 2:01
CSRF — Breaking anti-CSRF tokens
Animated, step-by-step: the ladder of token failures — not validated, only-when-present, not session-bound, reusable, POST-only, double-submit and predictable — each with a probe and a verdict.
▶ 12 steps⌘ 11 commands⏱ 1:59
08
SSRF
3 animationsAttack 1 — In-band SSRF to cloud metadata
Animated, step-by-step: a URL you supply becomes the server's own request, walked from localhost to the IAM credential endpoint.
▶ 11 steps⌘ 10 commands⏱ 1:56
Attack 2 — Blind SSRF, when nothing comes back
Animated, step-by-step: no response body, so the out-of-band callback becomes the proof — then timing turns the sink into an internal port scanner.
▶ 11 steps⌘ 10 commands⏱ 1:55
Attack 3 — The filter-bypass ladder
Animated, step-by-step: one rung at a time up an SSRF allowlist/blocklist — IP encodings, DNS tricks, @-authority, redirects, parser differentials and dangerous schemes.
▶ 14 steps⌘ 13 commands⏱ 2:26
09
JWT & Authentication
3 animationsAttack 1 — alg:none unsigned bypass
Animated, step-by-step: how a server that reads its algorithm from the token hands you an admin session.
▶ 16 steps⌘ 13 commands⏱ 2:36
Attack 2 — RS256 → HS256 algorithm confusion
Animated, step-by-step: turning a published public key into the signing key.
▶ 14 steps⌘ 12 commands⏱ 2:33
Attack 3 — kid header injection
Animated, step-by-step: path traversal, SQL injection and command injection through the key-id header.
▶ 12 steps⌘ 11 commands⏱ 2:16
10
Hidden Credentials
3 animationsAttack 1 — Secrets in the JavaScript bundle
Animated, step-by-step: your browser already downloaded 100% of the front-end — grep it, un-bundle the source map, and read what the client was never meant to tell you.
▶ 11 steps⌘ 11 commands⏱ 1:55
Attack 2 — The exposed .git directory
Animated, step-by-step: a deploy copied .git into the web root, so the entire version history — including the secret 'removed' three commits ago — is downloadable.
▶ 11 steps⌘ 10 commands⏱ 1:53
Attack 3 — Backups, config, debug pages and actuators
Animated, step-by-step: fuzz for the artefacts a deploy left behind, read the config that stores secrets on purpose, and take a found credential from disclosure to a proven, validated flag.
▶ 11 steps⌘ 10 commands⏱ 1:55
11
Business Logic
3 animationsAttack 1 — Price and quantity manipulation
Animated, step-by-step: mapping a checkout, finding the number the server takes on trust, and breaking it five ways without ever completing a purchase.
▶ 15 steps⌘ 14 commands⏱ 2:47
Attack 2 — Race conditions and TOCTOU
Animated, step-by-step: finding the gap between check and act, landing twenty requests inside it, and proving it was a race and not a retry.
▶ 13 steps⌘ 12 commands⏱ 2:34
Attack 3 — Workflow and step bypass
Animated, step-by-step: a four-step checkout whose state machine lives in the browser — skipped, forced, replayed and rewound.
▶ 12 steps⌘ 11 commands⏱ 2:16
12
Vulnerability Chaining
2 animationsChain 1 — three Low findings become one Critical
Animated, step-by-step: an information leak, an IDOR and a weak function-level check, drawn as a graph and walked from anonymous to administrator.
▶ 13 steps⌘ 12 commands⏱ 2:30
Chain 2 — client-side foothold to account takeover
Animated, step-by-step: a self-XSS nobody could deliver, a login form with no CSRF token, and a token sitting in localStorage — combined into full takeover.
▶ 13 steps⌘ 13 commands⏱ 2:34
13
Automation & Tooling
2 animationsBurp power features and writing your own check
Animated, step-by-step: match-and-replace, session macros, Intruder attack types, candidate generators — then the forty lines of Python for the check no tool ships.
▶ 14 steps⌘ 14 commands⏱ 2:30
The recon automation pipeline
Animated, step-by-step: discovery → resolution → live hosts → content → nuclei, each stage feeding the next as a file — and the judgement call of when not to automate at all.
▶ 14 steps⌘ 13 commands⏱ 2:27
14
Reporting
2 animationsFrom evidence to a finding
Animated, step-by-step: one finding written properly — title, asset, prerequisites, reproduction a stranger can follow, evidence discipline, impact in business terms, and a fix a developer can act on.
▶ 15 steps⌘ 15 commands⏱ 2:37
Severity, CVSS and retest
Animated, step-by-step: scoring one finding vector by vector, where scoring goes wrong, writing for executives and engineers, and the retest loop that closes the cycle.
▶ 15 steps⌘ 15 commands⏱ 2:35
15
Exam Prep & Mock
2 animationsWorking the 24-hour window like a normal day
Animated, step-by-step: the 90-minute plan deadline, the sign-off wait, an eight-hour hacking day in blocks, boxed flags, and the ten-minute debrief.
▶ 15 steps⌘ 15 commands⏱ 2:44
The rapid sweep across all eight classes
Animated, step-by-step: one disciplined first pass — the fastest high-value probe per class, a scope gate in front of every packet, and a verdict written down in minutes.
▶ 15 steps⌘ 15 commands⏱ 2:47
16
The Debrief
2 animationsWhat loses marks in the debrief
Animated, step-by-step: ten failure modes with the weak version and the corrected version of each — over time, narrated exploits, no scope, hedged claims, unreproducible findings and dead air.
▶ 12 steps⌘ 12 commands⏱ 2:09
The 10-minute debrief video
Animated, step-by-step: scripting the 2/5/3 structure from your own plan, staging the screen, rehearsing against a timer, and recording and verifying the take before the window closes.
▶ 12 steps⌘ 12 commands⏱ 2:08
Player controls — the same on every page
| Space | play / pause · K pause |
| ← → | previous / next step |
| J L | rewind (plays backwards) / fast-forward — press again for 4× and 8× |
| , . | nudge one second · R replay the current step |
| Home End | jump to start / end · 0–9 seek to 0–90% |
| C M | copy the current command / toggle loop |
the auto button | on = plays straight through · off = stops at the end of each step, so you can talk over it while teaching |
| drag the bar | scrub anywhere; the tick marks are step boundaries |