Offensive Security Training Opportunities - Part 2

banner

Intro

Welcome back to the series on Offensive Security Training Opportunities in 2025. In Part 1, I covered general pentesting training platforms, certifications, and courses that will help you get a foothold in the field or sharpen your skills as a pentester.

In this second installment, we’ll focus on training resources dedicated to web, API, and mobile application security. While some of the courses included in this list are suitable for beginners, it’s recommended to start with the foundational material before diving into the more specialized topics.

This post is Part 2 of the Offensive Security Training Opportunities in 2025. You can find the other posts in the links below:

Disclaimer: The opinions stated in this article are solely my own and do not necessarily reflect those of my employer or other affiliations I have/had. Next to that, courses are not listed in a specific order (this is no ranking by any means). Just because a course is listed in my post does not mean I have actively taken or bought the course, although I have participated in many of these and plan on taking more from this list.

TL;DR

If you are only interested in a summary, I have included a table at the end of every chapter with the necessary information.

Web (&API) Pentesting Overview
Mobile Pentesting Overview

Web (& API) Pentesting

Web and API training courses are valuable for pentesters looking to specialize in application security or expand beyond general infrastructure testing. This list includes hands-on labs, structured courses, and certification options that emphasize real-world attack scenarios and modern web technologies. Although some of them are beginner-friendly, a solid understanding of basic pentesting concepts is recommended before diving into these topics.

PortSwigger

“The best-in-class software and learning for security engineers and penetration testers”.

Portswigger Academy

PortSwigger Academy offers free course content on web application vulnerability topics including iterative labs to complete. The content is continuously updated, with new topics/labs are added regularly.

Cost

Free

Burp Suite Certified Professional (BSCP)

Based on the topics covered in their Academy, PortSwigger offers a standalone web application pentester certification. The exam is pretty hard giving you only 4 hours to completely pwn 2 web applications; however, no report is needed. It is recommended that you complete all practitioner level labs in the academy and do their practice exam. This is a must have for any web application penetration tester!

Cost

$90 for 1 exam voucher

Hack The Box

Via their academy platform HTB offers 2 web focused certifications:

HTB Certified Web Exploitation Specialist (CWES)

The CWES (FKA Certified Bug Bounty Hunter - CBBH) is an entry-level / intermediate web pentesting certification. It focuses on technical competency in the web application penetration testing and bug bounty domains. It focuses on black-box testing techniques. Course completion is required to start the exam.

Cost

To access the CWES course, only the Silver subscription is required. This costs €410/year (excl. VAT), including 1 exam voucher + 1 free retake

HTB Certified Web Exploitation Expert (CWEE)

The CWEE is an advanced web pentesting certification. It covers more advanced web attacks and also focuses more on white-box techniques. Course completion is required to start the exam.

Cost

To access the CWEE course, a gold subscription is required. This costs €1.055/year (excl. VAT), including 1 exam voucher + 1 free retake

INE Security

As part of their cyber training offering, INE offers the following web training + certifications:

INE Security Web Application Penetration tester (eWPT)

The eWPT covers essential web vulnerabilities and how to exploit them. This is assessed in a multiple-choice exam, in which you must conduct tests in a hands-on lab and then answer questions within 10 hours.

Cost

$599 for 3 months of premium pass* access + 1 exam attempt + 1 free retake. Afterwards, it’s $749 for the Premium pass annually. The premium pass gives access to INE’s entire content library.

INE Security Web Application Penetration Tester eXtreme (eWPTX)

The eWPTX continues where the eWPT left off. Covering more advanced techniques in the web application security domain focusing on topics such as WAF evasion and custom exploit development. The eWPTX is INE’s most advanced web penetration tester certification.

Cost

$599 for 3 months of premium pass* access + 1 exam attempt + 1 free retake. Afterwards, it’s $749 for the Premium pass annually. The premium pass gives access to INE’s entire content library.

OffSec

OffSec currently offers 2 web pentesting trainings/certifications:

Offensive Security Web Assessor (OSWA)

The OSWA covers foundational skills necessary to execute professional web application assessments. It covers essential techniques for identifying and exploiting XSS, SQL Injection, SSRF, and more. The course is geared towards entry-level to intermediate web attacks in black-box fashion.

Cost

The course is available in different pricing:

Standalone course: including 1 exam attempt, including 90 days lab access ($1.749)
Learn One annual subscription: including fundamental courses, KLCP and OSWP ($2.749)
Learn Unlimited annual subscription: including access to all of OffSec courses and unlimited exam attempts ($6.099)

Offensive Security Web Expert (OSWE)

The OSWE covers advanced web attacks and exploitation. The certification focuses on white-box web application testing and vulnerability exploitation, where chaining multiple vulnerabilities together is needed to pass the 48 hours practical exam.

Cost

The course is available in different pricing:

Standalone course: including 1 exam attempt, including 90 days lab access ($1.749)
Learn One annual subscription: including fundamental courses, KLCP and OSWP ($2.749)
Learn Unlimited annual subscription: including access to all of OffSec courses and unlimited exam attempts ($6.099)

Synacktiv

Synacktiv is a cybersecurity company founded by two IT security experts from France. It has grown into one of the established names in the field. They only recently added live/virtual trainings to their portfolio. Their onsite trainings are delivered in Paris and in French; however, their online sessions are taught in English. You can find their training schedule on their training page.

Attacking Web Applications

During this five-day training, participants will study the functioning of the security mechanisms implemented in recent web applications. The various exercises resulting from the feedback of our experts will allow them to refine their intrusion methods for the exploitation of complex vulnerabilities. Finally, learners will be able to understand the specificity of Java, PHP, Python and ASP.NET languages and frameworks, using dedicated modules.

Cost

€4.500* excl. VAT for 5 day training online (English) or in-person (currently only in Paris and in French)

* cost is based on other 5 day trainings listed on their platform.

Practical Web 0-Day Hunting

During this five-day course, you will acquire the skills necessary to identify complex vulnerabilities within the source code of Java, PHP and .NET applications. Based on many practical cases on popular frameworks such as Spring or Symfony, participants will learn how to optimize their research using static and dynamic analysis tools. It is recommended to have a solid understanding of Web application technologies and vulnerabilities before enrolling in the course.

Cost

€4.500* excl. VAT for 5 day training online (English) or in-person (currently only in Paris and in French)

* cost is based on other 5 day trainings listed on their platform.

APISEC University

Training provider focusing purely on API Security, instructed by Corey J. Ball (known author of Hacking API’s) . They offer multiple free API security courses on their website.

API Security (ASCP)

The API penetration testing course providing hands-on training, focusing on techniques to identify and address API specific vulnerabilities. The exam consists of 2 API-driven applications which have to be exploited and reported.

Cost

Course material is free, The exam costs $450 + 1 free retake

Agarri.fr

Mastering Burp Suite 100% Hands-on

This training is offered by Nicolas Grégoire, an official Burp Suite Pro trainer. He will teach you how to master Burp Suite Pro in in-person or online training format training for 4 consecutive days. The training is regularly scheduled at security conferences and by Nicolas himself. It’s offered in French and English. This training does not include a certification exam.

Cost

The training pack normally costs €3.133. However, they regularly offer early bird discounts. Private training options are also available.

Overview

Training Name	Certification Name	Vendor	Training Format	Certification	Level	Cost (excl. VAT)	Info	Link
PortSwigger Academy	Burp Suite Certiied Practitioner (BSCP)	Portswigger	Online Labs	Proctored exam, 4 hours, Hands-on Lab	Intermediate	Free, Exam: $90	Course and labs are free, Exam attempt cost $90	Course Link
Web Penetration Tester Job-Role Path	HTB Certified Web Exploitation Specialist (CWES)	Hack The Box	On-Demand course, Labs	Non-proctored exam, 7 days, Hands-on Lab + report	Entry-Level / Intermediate	€410	Annual subscription, 1 exam attempt + retake, 100% course completion required	Course Link
Senior Web Penetration Tester Job-Role Path	HTB Certified Web Exploitatin Expert (CWEE)	Hack The Box	On-Demand course, Labs	Non-proctored exam, 10 days, Hands-on Lab + report	Expert	€1.055	Annual subscription, 1 exam attempt + retake, 100% course completion required	Course Link
Web Application Penetration Testing Professional Learning Path	Web Application Penetration Tester (eWPT)	INE Security	On-Demand course, videos, labs	Non-proctored exam, 10 hours, Multiple choice, Hands-on Lab	Entry-level	$599	3 Month access 1 exam attempt + retake	Course Link
Advanced Web Application Penetration Testing	Web Application Penetration Tester eXtreme (eWPTX)	INE Security	On-Demand course, videos, labs	Non-proctored exam, 7 days (+ 7 days), Hands-on Lab + report	Intermediate	$599	3 Month access 1 exam attempt + retake	Course Link
WEB-200: Foundational Web Application Assessments with Kali Linux	OffSec Web Assessor (OSWA)	OffSec	On-Demand course, Labs	Proctored exam, 24 hours (+24 hours), Hands-On Lab + report	Intermediate	$1.749	3 month lab access 1 exam attempt	Course Link
WEB-300: Advanced Web Attacks and Exploitation	OffSec Web Expert (OSWE)	OffSec	On-Demand course, Labs	Proctored exam, 48 hours (+24 hours), Hands-On Lab + report	Expert	$1.749	3 month lab access 1 exam attempt	Course Link
Attacking Web Applications	X	Synacktiv	Live in-person/virtual	No	Intermediate	€4.500	5 day in-person (French) or virtual course (English)	Course Link
Practical Web 0-day hunting	X	Synacktiv	Live in-person/virtual	No	Intermediate / Expert	€4.500	5 day in-person (French) or virtual course (English)	Course Link
API Penetration Testing Course	API Security Certified Professional	APISEC University	On-Demand course, Labs	Non-proctored exam, 12 hours, Hands-on Lab	Intermediate	Free, Exam $450	Course is Free, $450 Exam attempt + 1 free retake	Course Link
Mastering Burp Suite Pro	X	Agarri.fr	Live in-person/virtual	No	Intermediate / Expert	€3.133	4 day in-person or virtual course	Course Link

Mobile Pentesting

These trainings are ideal for pentesters or developers who want to expand into mobile security testing. The resources in this section will help you understand common vulnerabilities, mobile-specific attack surfaces, and secure development practices.