What you'll learn
- Write and respect a testing scope
- Recognize requests, responses, and status codes
- Start a supervised exercise in PortSwigger Web Security Academy
Set a testing scope before using tools
Ethical security testing is technical work with explicit permission. Scope defines which assets you may test, what is allowed, and which actions are off-limits.
Hands-on steps
- Create a text note titled Authorized Security Lab.
- Write the target as an approved training lab, such as your own local demo or a lab launched from PortSwigger Web Security Academy.
- Record allowed activity (view pages, inspect requests, follow lab instructions) and avoid actions outside lab boundaries.
- Write down the test date and one learning goal. Keep results in a private notebook.
Remember: Owning a domain name does not mean every service or third-party component behind it is in your testing scope.
Knowledge check: If a company site is publicly reachable, is it automatically okay to scan it?
No. Public access alone is not authorization for intrusive security testing.
Understand the HTTP conversation
A browser asks a web server for a resource using an HTTP request. The server replies with a status code, headers, and often a page or data.
Hands-on steps
- Open a browser and visit https://example.com, a harmless example domain.
- On a desktop browser, open Developer Tools and find the Network tab. Reload the page. (On Android, you can read the concepts now and practice later on a computer.)
- Click the document request and identify the URL, request method (usually GET), and response status code.
- In your notes, write what 200, 301/302, 403, and 404 generally indicate.
Remember: GET commonly fetches data; POST commonly submits data. A status code is an important clue, not a complete security verdict.
Knowledge check: What does HTTP status 404 usually mean?
The requested resource was not found at that URL.
Get comfortable with Burp Suite
Burp Suite Community Edition is a useful free desktop proxy for studying web requests. Practice only with your own demo or a purpose-built lab.
Hands-on steps
- Install Burp Suite Community Edition from the official PortSwigger website on a computer.
- Launch Burp and open its built-in browser from the Proxy tools.
- Visit an approved training lab or example.com in that built-in browser.
- Review the HTTP history and identify one request URL, one method, and its response status. Use Intercept Off if the browser appears stuck.
Remember: You can learn a lot from observing traffic before changing any request.
Knowledge check: Why might a webpage appear frozen when Burp Intercept is on?
Burp may be holding a request until you forward it or turn Intercept off.
Try your first guided security lab
PortSwigger Academy provides free exercises designed for learning. Use a lab account if you want to track progress; some exercises require a desktop environment.
Hands-on steps
- Visit https://portswigger.net/web-security/getting-started and read the beginner introduction.
- Pick a beginner-friendly topic and launch an Academy lab using its official instructions.
- Before making a change, note the lab goal, a page URL, the current HTTP method, and the status code.
- Follow only the lab instructions to finish the exercise. Write a short report: observation, issue, impact inside the lab, and recommended defense.
Remember: Focus on explaining the cause and the mitigation, not just reaching the lab success screen.
Knowledge check: What should a useful finding include besides a vulnerability name?
Reproducible observation, effect or impact, scope, and a practical recommended fix.
Reliable places to learn more
These are independent educational resources, not paid endorsements.
