Work through a lab
Free, public, no sign-up. The same labs used inside the programme. If the teaching does not suit you, you will know in an evening.
Open the free labsWeb Application Security Practitioner
Test a real web application end to end, prove what you find, and write the report a security team would accept.
Test a real web application end to end against the OWASP Top 10 and common API flaws, and write a report a security team would accept. Weekly 1:1, labs reviewed every week.
What you will be able to do
- Test a web application end to end against the OWASP Top 10
- Test an API against BOLA, auth and JWT flaw classes
- Run an authenticated scan and separate real findings from scanner noise
- Find the cloud and pipeline mistakes that show up in real engagements
- Prove a finding rather than assert it, and score it defensibly
- Write a report a security team would accept
- Walk into an interview with work you can defend
Who it is for
- Students and graduates targeting an application-security or VAPT role
- IT and development professionals moving into security
- Self-taught testers who can find bugs but cannot yet report them credibly
- Anyone who has finished courses but never had work reviewed by a practitioner
Two sessions a week, five days of doing
Two live 1:1 sessions every week, on days fixed with you once we start. The other five days are yours to work — research, assignments, labs, writeups. Session length is agreed per student and can change as you go.
- Two live 1:1 sessions a week, on days agreed with you
- The remaining five days are for the work — research, assignments, labs, reports
- Session hours are set per student, and can be adjusted mid-programme
- Everything you hand in is reviewed before the next session
My job
- Guide you — tell you how to do things, and why it is done that way
- Tell you what you need to do, and when to do it
- Review everything you produce and tell you plainly where it falls short
- Keep the plan honest as you change and as the field changes
Your job
- Do the work, as per the guidance
- Turn it in, so it can be reviewed
- Ask when you are stuck — with a question someone can reproduce
- Keep showing up; the change comes from accumulation, not intensity
We work together to build your career in this field. Do not expect a traditional class with slides delivered at you. Expect a class that guides you, mentors you, changes how you work, and helps you build yourself into a cybersecurity researcher.
Syllabus
Three phases across twelve weeks, 43 topics in total. Each topic is taught against work you do and hand in — there is nothing here you watch.
-
The ground the rest of the programme stands on: a working environment, the shell, the network, enough Python to automate your own testing, how HTTP and sessions really behave — and the authorisation discipline you need before touching anything.
Building your lab and workflow
- Linux or Kali VM build
- isolated browser profile for testing
- note-taking and evidence folder structure
- scope file and written authorisation record
Linux and the command line
- shell navigation, pipes, redirection
- grep, sed and awk for response and log triage
- file permissions and ownership
Networking essentials
- TCP/IP, ports, DNS resolution
- TLS handshake basics
- loopback and proxy-chain traffic
Python for security work
- requests: driving an application without a browser
- parsing JSON and HTML responses
- scripting a repetitive check instead of clicking it 200 times
- turning scanner output into something readable
- writing one small tool you will actually reuse
Working with a proxy and browser tools
- proxy CA certificate install and trust
- interception verified before any real work starts
- explicit scope restricted to the authorised target
- passive walk of the app before active testing
- DevTools correlated with the proxy as a habit
How HTTP really works
- request and response anatomy
- methods, status codes, redirects
- header glossary built from observed traffic, not from a list
- client-side expectation versus server-side enforcement
Cookies, sessions and authentication
- Set-Cookie attribute checklist — HttpOnly, Secure, SameSite, Path, Domain, expiry
- session fixation checks
- logout that actually invalidates server-side
- token location and exposure reasoning
Authorisation, scope and ethics
- authorisation, scope boundaries, rules of engagement
- stop-and-report conditions
- what you never touch, even when you can
-
Every vulnerability class you will be hired to find, on the web and in APIs, each taken from first probe to proven impact — then the scanner workflow, cloud and pipeline work that Indian job postings actually ask for, and the reporting craft that turns findings into something a team can act on.
-
The work is done — now make it count. A portfolio and published writeup, a résumé that survives an automated screen, a certification route that gets you past HR, and interviews rehearsed under real conditions.
Not ready to commit? Start smaller.
Most people should not hand a stranger ₹39,000 on a first visit. There are two cheaper ways in, and both tell you more than a brochure would.
Talk it through
A short call about where you actually are and what you are aiming at. If this is not the right thing for you, you will be told so.
Ask for a callFee and enrolment
₹39,000 as 3 × ₹13,000 monthly — or ₹36,000 paid upfront (₹3,000 off)
Pay in three monthly instalments, or pay the full fee upfront for a discount. The fee line above states both.
Session hours are set per student when your plan is written, and can be adjusted as you go — your invoices follow whatever is agreed.
Terms, in plain words
- The price is on this page. There is no counselling call you have to sit through to find out what it costs.
- Everything needed is included — labs, materials, reviews and the certificate. Third-party exam fees, if you choose to sit one, are yours and are named upfront.
- Pay monthly or upfront. Nothing is charged when you apply.
- If it is not working, say so. Unused sessions are refundable pro rata — the hour ledger in your portal shows exactly what has been used.
- 01
Apply
A short form. No account, no payment. I read every one personally and reply within two working days.
- 02
A call
We talk about where you are, what you are aiming at, and whether this is the right thing for you. If it is not, I will say so.
- 03
A plan tailored to you
A written plan for your goal — the skills it breaks into, the resources chosen for each one, and the session rhythm and hours that fit your week.
- 04
Start
Sessions are scheduled, the plan goes live in your portal, and the work begins.
Where this points
The roles this programme is built to make you credible for.
- Application security engineer
- Penetration tester — web and API
- VAPT analyst or consultant
- Security engineer, product or platform
- Bug bounty hunter, working methodically
Who teaches it
Sarath G — Application Security Consultant & Cybersecurity Trainer. One mentor, one student at a time. No teaching assistants, no cohort, no recorded lectures.
- 9+
- years in the field
- 1,600+
- hours of instruction delivered
- 30,000+
- people trained
- 10+
- countries taught in, onsite
Figures as published on sarathg.me. Certifications held: CEH Master · CPENT · LPT Master · CHFI · CEI · ISC2 CC · WAHS.
- Built the labs you will work in — ShopEasy, Pandora and a live Wazuh SOC environment, all hosted free at labs.sarathg.me
- Wrote the curriculum himself: 274 field guides, cheatsheets, assignments, labs and research briefs, tagged to a competency taxonomy
- Author of Certified and Clueless (ISBN 9789360381264), the book behind the DARE framework
- Reviews every submission personally — assignments, labs, reports and writeups, with written feedback, not a score
- Runs the whole engagement in the open: a written plan, per-skill progress, and a visible hour ledger you can check
What this is not
- No job guarantee, and no "placement assistance" that turns out to mean a resume template
- No recorded video library sold as live teaching
- No batch of thirty with a teaching assistant answering your questions
- No counselling call before you are told the price — it is on this page
- No certificate from me. You leave with work you can show, and a route to third-party exams that employers actually recognise
Questions
Apply for Web Application Security Practitioner
A short form — no account, no payment. Read personally, answered within two working days.
Also available
- SOC Analyst (Splunk & Sentinel) ₹39,000 as 3 × ₹13,000 monthly — or ₹36,000 paid upfront (₹3,000 off)
- Monthly 1:1 mentorship (open-ended) ₹15,000 per month