Theory is cheap — I run every OWASP Top 10 category against intentionally vulnerable apps:
| Category | Lab practice |
|---|---|
| A01 Broken Access Control | IDOR, path traversal, forced browsing |
| A02 Cryptographic Failures | Weak hashing, plaintext secrets |
| A03 Injection | SQLi with sqlmap, XSS payloads |
| A04 Insecure Design | Password reset logic flaws |
| A05 Security Misconfiguration | Default creds, verbose errors |
Burp Suite + ZAP give me the traffic view; Kali gives me the weaponized tooling.
Next up: chaining findings the way a real red-team engagement would.