Project Brief — Black-Box Assessment of a Vulnerable Web App

This capstone brings every skill from the course together in a realistic engagement: a black-box penetration test of a vulnerable web application, followed by remediation and a professional report. Black-box means you begin with no inside knowledge, only what an external attacker would have, so you must discover the application's surface, find and exploit its flaws, then fix them and prove the fixes hold.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

This lesson is the brief. It defines the phases you will work through, recon, exploitation, remediation, and reporting, and, most importantly, the rules of engagement and ethics that govern any real assessment. Understanding the professional framing matters as much as the technical work, because a penetration test is a legally and ethically bounded activity, not free-form hacking, and the report is often the most valuable deliverable.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.