Overview
This roadmap supports the eWAPT v2 course with hands-on labs on TryHackMe and PortSwigger, organized into 8 sections that follow the course flow: how the web works, web hacking fundamentals, Burp Suite, XSS, SQL injection, and the supporting pentesting tools.
The roadmap was put together by Netriders Academy, with the labs curated by Ahmed Sultan. Pair it with my eWPTv2 Study Notes for the theory behind each topic. Every link opens the lab directly.
| Total labs | 70 |
| TryHackMe | 32 |
| PortSwigger Web Security Academy | 38 |
| Sections | 8 |
Note: two rooms, Burp Suite: The Basics and SQL Injection Lab, appear in more than one section because they support more than one topic, so the total counts each appearance. TryHackMe also occasionally moves rooms between free and paid, so if you find a lab that is locked, let me know and I will update the list.
Section Map
| # | Section | Focus | Labs |
|---|---|---|---|
| 01 | How the Web Works | DNS, HTTP, and the request/response cycle | 4 |
| 02 | Web Hacking Fundamentals | Burp Suite, OWASP Top 10, and first exploitation | 5 |
| 03 | Introduction to Web Hacking | Content discovery, authentication bypass, and injection basics | 6 |
| 04 | Burp Suite | Repeater, Intruder, and extensions | 5 |
| 05 | XSS & Web Security | Reflected, stored, DOM-based, and context-based XSS | 28 |
| 06 | SQL Injection | From fundamentals to UNION and Blind SQLi | 16 |
| 07 | Extra Lab | Supplementary practice | 1 |
| 08 | Pentesting Tools | Nmap, Metasploit, John the Ripper, Nessus, and Hydra | 5 |
Suggested Learning Path
- Foundations: How the Web Works -> Web Hacking Fundamentals -> Introduction to Web Hacking
- Core tooling: Burp Suite
- Attack techniques: XSS & Web Security -> SQL Injection
- Supporting tools: Pentesting Tools, which can be studied alongside the earlier sections
- Bonus: Extra Lab
PortSwigger difficulty levels: Apprentice -> Practitioner -> Expert. If you are new to XSS or SQL injection, complete the Apprentice labs in each subsection before attempting the harder ones.
01. How the Web Works
Focus: DNS, HTTP, and the request/response cycle
Labs: 4
Before attacking a web application, understand how it works: DNS resolution, HTTP in detail, and how a browser and server exchange data from end to end.
| # | Lab | Platform |
|---|---|---|
| 1 | DNS in Detail | TryHackMe |
| 2 | HTTP in Detail | TryHackMe |
| 3 | How Websites Work | TryHackMe |
| 4 | Putting It All Together | TryHackMe |
02. Web Hacking Fundamentals
Focus: Burp Suite, OWASP Top 10, and first exploitation
Labs: 5
Your first hands-on exposure to web attacks: getting comfortable with Burp Suite, working through the OWASP Top 10 and Juice Shop, exploiting file upload vulnerabilities, and a first CTF-style machine to tie it together.
| # | Lab | Platform |
|---|---|---|
| 1 | Burp Suite: The Basics | TryHackMe |
| 2 | OWASP Top 10 - 2021 | TryHackMe |
| 3 | OWASP Juice Shop | TryHackMe |
| 4 | Upload Vulnerabilities | TryHackMe |
| 5 | Pickle Rick | TryHackMe |
03. Introduction to Web Hacking
Focus: Content discovery, authentication bypass, and injection basics
Labs: 6
Core web attack techniques: walking an application methodically, discovering hidden content, bypassing authentication, enumerating subdomains, and exploiting OS command injection and SQL injection.
| # | Lab | Platform |
|---|---|---|
| 1 | Walking An Application | TryHackMe |
| 2 | Content Discovery | TryHackMe |
| 3 | Authentication Bypass | TryHackMe |
| 4 | Subdomain Enumeration | TryHackMe |
| 5 | OS Command Injection | TryHackMe |
| 6 | SQL Injection Lab | TryHackMe |
04. Burp Suite
Focus: Repeater, Intruder, and extensions
Labs: 5
A deeper pass on Burp Suite: Repeater for manual testing, Intruder for automated attacks, and the other modules and extensions that make it the core tool of every web pentester.
| # | Lab | Platform |
|---|---|---|
| 1 | Burp Suite: The Basics | TryHackMe |
| 2 | Burp Suite: Repeater | TryHackMe |
| 3 | Burp Suite: Intruder | TryHackMe |
| 4 | Burp Suite: Other Modules | TryHackMe |
| 5 | Burp Suite: Extensions | TryHackMe |
05. XSS & Web Security
Focus: Reflected, stored, DOM-based, and context-based XSS
Labs: 28
The largest section in the roadmap. Start with the TryHackMe rooms for XSS and CORS fundamentals, then work through the PortSwigger XSS track: DOM-based sinks, injection contexts, filter bypasses, exploitation techniques like cookie theft and CSRF via XSS, and CSP bypass.
TryHackMe
| # | Lab | Platform |
|---|---|---|
| 1 | Advanced XSS | TryHackMe |
| 2 | XSS | TryHackMe |
| 3 | CORS & SOP | TryHackMe |
PortSwigger - Reflected & Stored XSS
| # | Lab | Level |
|---|---|---|
| 4 | Reflected XSS into HTML context with nothing encoded | Apprentice |
| 5 | Stored XSS into HTML context with nothing encoded | Apprentice |
PortSwigger - DOM-Based XSS
PortSwigger - XSS Contexts
PortSwigger - Exploiting XSS
| # | Lab | Level |
|---|---|---|
| 25 | Exploiting XSS to steal cookies | Practitioner |
| 26 | Exploiting XSS to capture passwords | Practitioner |
| 27 | Exploiting XSS to perform CSRF | Practitioner |
PortSwigger - Content Security Policy
| # | Lab | Level |
|---|---|---|
| 28 | Reflected XSS protected by CSP, with CSP bypass | Expert |
06. SQL Injection
Focus: From fundamentals to UNION and Blind SQLi
Labs: 16
SQL injection from the ground up on TryHackMe, then applied on PortSwigger through UNION attacks and the early stages of Blind SQL injection.
TryHackMe
| # | Lab | Platform |
|---|---|---|
| 1 | SQL Fundamentals | TryHackMe |
| 2 | Advanced SQL Injection | TryHackMe |
| 3 | SQL Injection Lab | TryHackMe |
PortSwigger - Basic
| # | Lab | Level |
|---|---|---|
| 4 | SQL injection vulnerability in WHERE clause allowing retrieval of hidden data | Apprentice |
| 5 | SQL injection vulnerability allowing login bypass | Apprentice |
PortSwigger - Examining the Database
| # | Lab | Level |
|---|---|---|
| 6 | Querying the database type and version on Oracle | Practitioner |
| 7 | Querying the database type and version on MySQL and Microsoft | Practitioner |
| 8 | Listing the database contents on non-Oracle databases | Practitioner |
| 9 | Listing the database contents on Oracle | Practitioner |
PortSwigger - UNION Attacks
| # | Lab | Level |
|---|---|---|
| 10 | UNION attack: determining the number of columns | Practitioner |
| 11 | UNION attack: finding a column containing text | Practitioner |
| 12 | UNION attack: retrieving data from other tables | Practitioner |
| 13 | UNION attack: retrieving multiple values in a single column | Practitioner |
PortSwigger - Blind SQL Injection
| # | Lab | Level |
|---|---|---|
| 14 | Blind SQLi with conditional responses | Practitioner |
| 15 | Blind SQLi with conditional errors | Practitioner |
| 16 | Blind SQLi with time delays | Practitioner |
07. Extra Lab
Focus: Supplementary practice
Labs: 1
An additional room that complements the core roadmap.
| # | Lab | Platform |
|---|---|---|
| 1 | Common Attacks | TryHackMe |
08. Pentesting Tools
Focus: Nmap, Metasploit, John the Ripper, Nessus, and Hydra
Labs: 5
The essential tools that support every web assessment: port and service scanning with Nmap, exploitation with Metasploit, password cracking with John the Ripper, vulnerability scanning with Nessus, and online password attacks with Hydra.
| # | Lab | Platform |
|---|---|---|
| 1 | Further Nmap | TryHackMe |
| 2 | Metasploit: Introduction | TryHackMe |
| 3 | John The Ripper: The Basics | TryHackMe |
| 4 | Nessus | TryHackMe |
| 5 | Hydra | TryHackMe |
Tips for Getting the Most Out of These Labs
- Take notes on every lab: the payload, the request, and the reasoning behind it, so you can come back to them later.
- Avoid walkthroughs until you have genuinely tried on your own. PortSwigger’s hints and solutions are there for when you are stuck, not as a first step.
- Repeat labs a few days later without looking at the solution. This is what makes the knowledge stick.
- Learn XSS by context: for each PortSwigger XSS lab, identify where your input lands (HTML, attribute, JavaScript string, DOM sink) before choosing a payload. This habit is what the exam tests.
These labs are for learning and practice in authorized environments only. Never test any technique on systems you do not own or have explicit permission to test.