Skip to main content Scroll Top

Sourabh Sahu

April 25, 2026

QR Code
ISSUED ON:
April 25, 2026

Sourabh Sahu

ARMOUR INFOSEC WEB APPLICATION PENETRATION TESTER (AIWAPT)
Skills / Knowledge:
  • Web Application Security
  • Web Server Architecture & Security
  • HTTP/HTTPS Protocols
  • Web Application Architecture
  • Reconnaissance & Enumeration
  • OWASP Top 10
  • Vulnerability Assessment
  • Penetration Testing
  • Burp Suite
  • Nmap
  • Nuclei
  • Acunetix
  • SQL Injection (Classic, Blind, OOB)
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Authentication & Session Management
  • Access Control (IDOR)
  • File Inclusion (LFI/RFI)
  • Server-Side Request Forgery (SSRF)
  • XML External Entity (XXE)
  • Security Misconfiguration
  • Sensitive Data Exposure
  • Cryptography & Hashing
  • File Upload Vulnerabilities
  • Insecure Deserialization
  • Clickjacking
  • CORS & Security Headers
  • API & Web Services Security
EXPIRES ON: Does Not Expire​
EARNING CRITERIA: Course
Download Certificate
Download this certificate in PDF and PNG. For Printing, download the PDF version from your Desktop/PC for high quality.
Share Certificate​
Show this certificate on your social network.​
An ARMOUR INFOSEC Web Application Penetration Tester (AIWAPT) has demonstrated in-depth knowledge and hands-on expertise in web application security testing, vulnerability assessment, and exploitation. They are proficient in:
  • Web Application Fundamentals: Understanding web application architecture, client-server interaction, HTTP/HTTPS protocols, cookies, sessions, and security boundaries.
  • Web Server Fundamentals: Knowledge of web server architectures (Apache, Nginx, IIS), deployment environments, and common attack surfaces.
  • Reconnaissance & Enumeration: Performing information gathering through crawling, spidering, forced browsing, fingerprinting, and attack surface mapping.
  • Web Application Testing Methodology: Applying structured penetration testing processes including target discovery, analysis, exploitation, and validation.
  • OWASP Top 10 Alignment: Ability to identify, exploit, and remediate vulnerabilities mapped to OWASP Top 10 (Web) and OWASP API Security Top 10 standards.
  • Injection Vulnerabilities: Identifying and exploiting SQL Injection (classic, blind, out-of-band), OS command injection, and XML/XPath injection.
  • Authentication & Session Vulnerabilities: Assessing authentication mechanisms and exploiting weaknesses such as weak credentials, session hijacking, and session fixation.
  • Access Control Vulnerabilities: Identifying and exploiting authorization flaws including IDOR and privilege escalation.
  • Client-Side Vulnerabilities: Exploiting Cross-Site Scripting (Reflected, Stored, DOM), Clickjacking, and bypassing client-side controls.
  • CSRF Vulnerabilities: Understanding and exploiting Cross-Site Request Forgery attacks and weaknesses in request validation.
  • File & Resource Vulnerabilities: Exploiting Local File Inclusion (LFI), Remote File Inclusion (RFI), directory traversal, and insecure file uploads.
  • Security Misconfiguration: Identifying insecure configurations such as default credentials, improper HTTP headers, CORS issues, and exposed services.
  • Sensitive Data Exposure & Cryptography: Assessing risks related to insecure data storage, weak encryption, and improper handling of sensitive information.
  • Advanced Web Vulnerabilities: Understanding and exploiting SSRF, XXE, and insecure deserialization in modern web applications.
  • API & Web Services Security: Testing APIs for authentication flaws, input validation issues, and excessive data exposure.
  • Security Tools & Automation: Utilizing tools such as Burp Suite, Nmap, Nuclei, and scanners for efficient vulnerability discovery and testing.
  • Information Disclosure & Error Handling: Identifying improper error handling, debug exposure, and leakage of sensitive system information.