Start authorized web security practice

Learn web security in purpose-built training labs and keep testing inside an explicit permission boundary.

1. 01

   Choose a contained training lab

   Use PortSwigger Web Security Academy and read the selected topic before launching its training lab. Test only the lab instance or a system you own and are explicitly authorized to assess.

   Before moving on: You can name the exact authorized target and explain the lab objective before sending requests.

   

   PortSwigger Web Security AcademyView access details and original source →
2. 02

   Understand the request and response

   Use a request viewer or Hoppscotch against a service you control to inspect methods, status codes, and headers. Use sample credentials and avoid collecting other people’s data.

   Before moving on: Your notes distinguish the observed response from assumptions about the application.

   

   Hoppscotch Community EditionView access details and original source →
3. 03

   Write a useful lab note

   Record the training URL, the relevant request, the underlying issue, and a defensive mitigation in your own words. Remove tokens and personal data before sharing a report.

   Before moving on: Another learner can understand the issue and its fix without access to your account or secrets.

   

   JoplinView access details and original source →

Go deeper: Read the practical guide →

These are suggested learning sequences, not a promise of compatibility or free hosted services. Check each provider’s current requirements and terms.