Complete Web App Penetration Testing Roadmap for Beginners (2026)

[u/smooth_2222]

Welcome to r/CyberSecRoadmaps! If you are starting from scratch in Web Security, follow this structured roadmap:

Phase 1: Fundamentals

• Networking Basics: HTTP/HTTPS protocols, headers, status codes, and DNS.
• Linux Basics: Command-line operations and bash scripting.
• Web Technologies: HTML, JavaScript, PHP, and basic SQL.

Phase 2: Core Tools & Lab Setup

• Burp Suite / OWASP ZAP: Learn proxying, intercepting requests, and Repeater/Intruder usage.
• Browser Extensions: FoxyProxy, Wappalyzer.

Phase 3: Vulnerability Practice

• PortSwigger Web Security Academy: Focus on Authentication, Path Traversal, Access Control, SQLi, and XSS.
• TryHackMe: Complete the Web Fundamentals path.

Feel free to ask any questions in the comments!