Human judgement, AI speed.
Aveas Professional
Hands-on Web Application and API Penetration Testing
Plan and run a web application and API penetration test end to end: find and exploit real weaknesses, verify AI-generated findings with evidence, chain issues into attack paths, and write reports developers can fix.
About this certification
Aveas Professional is for practitioners. It covers the full engagement, from scoping and reconnaissance through exploitation to the report and the retest, with most of the time spent hands-on in purpose-built lab applications.
A theme runs through every module: verification. Automated and AI-assisted testing produce many candidate findings; a professional proves which ones are exploitable, shows the impact with safe evidence, and discards the rest. That judgement is what the certification measures.
Who it is for
- Penetration testers and ethical hackers
- Application security engineers running continuous testing
- Security consultants delivering web and API assessments
- Senior developers who own security on SaaS, fintech and healthtech products
What you will be able to do
- Plan, scope and run a web application and API penetration test end to end
- Find and exploit access-control, injection, authentication and business-logic flaws
- Verify automated and AI-generated findings, prove exploitability and eliminate false positives
- Chain lower-severity issues into a demonstrated attack path
- Write findings with reproduction steps, impact and remediation that developers can fix
- Run retests and track findings to closure in Jira or GitHub
Course outline
9 modules · 28 topics · outline may be refined before launch
1Engagement planning and reconnaissance3 topics
Start every test with a clear scope and a complete map.
- Scoping, rules of engagement and test accounts
- Mapping applications, APIs and hidden endpoints
- Technology fingerprinting and attack-surface inventory
2Authentication and session attacks3 topics
Break how users prove who they are.
- Password spraying, stuffing and multi-factor bypasses
- Session fixation, token handling and JWT weaknesses
- Password reset and account takeover paths
3Access control and multi-tenancy3 topics
The most common serious finding in SaaS.
- IDOR and broken object-level authorization
- Vertical and horizontal privilege escalation
- Tenant isolation in multi-tenant products
4Injection and server-side attacks4 topics
When input becomes code or a request.
- SQL and NoSQL injection
- Command and template injection
- Server-side request forgery and cloud metadata
- Insecure deserialization and file upload
5Client-side attacks3 topics
Attacks that run in the victim's browser.
- Stored, reflected and DOM-based XSS
- CSRF, CORS misconfiguration and clickjacking
- Content Security Policy and its bypasses
6API and GraphQL testing3 topics
Test the interfaces products are built on.
- REST testing from an OpenAPI description
- GraphQL introspection, batching and authorization
- Webhooks and service-to-service trust
7Business-logic flaws3 topics
Flaws no scanner understands.
- Payment, refund and pricing workflows
- Race conditions and limit bypasses
- Abusing intended features
8Verifying AI-generated findings3 topics
Human judgement on machine-speed output.
- Triage: reproduce, confirm, or discard
- Safe proof-of-concept and evidence capture
- Chaining findings into an attack path
9Reporting, retesting and remediation3 topics
A finding is done when it is fixed and retested.
- Writing findings: impact, reproduction, remediation
- Executive summaries for non-specialists
- Tickets in Jira or GitHub, retests and closure
The exam
Planned format. The final details are published when the certification opens.
- Format
- A practical exam: a timed engagement against a purpose-built lab application
- Deliverable
- A written penetration test report, graded by a person against a published rubric
- What counts
- Exploitability proven with evidence, not the number of findings
- Details
- Lab duration, report deadline and pass criteria are published when the certification opens
Prerequisites
Aveas Fundamentals, or equivalent experience. Working knowledge of HTTP, a proxy such as an intercepting web proxy, and basic scripting is expected.
Certificate and badge
an authorized certificate authority, verified on VeraGen LearnA certificate issued by Aveas, with a unique ID and QR code that anyone can check on the Verify page, and an Aveas Professional digital badge.
Get notified when it opens
Aveas Professional opens in 2027. Leave your email and we will tell you when enrollment opens.