Lion Cipher Lab
Run a complete web application security assessment (capstone)
- AppSec / DevSecOps
- Advanced
- ~4-6 hours (can be split across sessions)
- Free · no account required
Why it matters
Knowing five bug classes is not the same as being able to assess an application. The job — bug bounty, a junior pentest role, security-reviewing your own product before launch — is to take an app you've never seen, cover it methodically so you can honestly say what you tested, chain what you find into the worst realistic outcome, rate each finding so a busy engineer knows what to fix first, and write it up so someone who wasn't there can act on it. That whole loop is a skill in its own right, and it is the one employers actually pay for. This capstone runs it end to end on a target you own,…
What you'll learn
- Web application penetration testing methodology
- Scoping and rules of engagement
- OWASP WSTG coverage-driven testing
- Chaining vulnerabilities for higher impact
- OWASP risk rating (likelihood x impact)
- Writing a professional assessment report
Steps in this lab
- What a capstone assessment is — and the one rule that makes it legal
- Write your scope and rules of engagement (10 minutes, do not skip)
- Build the coverage checklist from the WSTG categories
- Recon: map the attack surface
- Work the categories: automate first, then test what tools can't
- The chain: combine two findings into a bigger one
- Rate every finding: Risk = Likelihood x Impact
- Write the report: the deliverable that makes it professional
- Debrief — what you actually learned to do