Application Security Course in Hyderabad
Test web applications, APIs, Android apps and thick-client software by method, then report and retest, in six weeks.
- Duration6 weeks
- Guided hours90 hours
- LevelIntermediate
- Fee₹20,000 + GST
- FormatTrack weeks 1–6
- BatchesSchedule
In plain words: You learn how websites, APIs, Android apps and desktop software can be broken into, and how to prove each weakness and report it clearly. New to the terms?
- 6 weeks, 3 hours a day, Monday to Friday: 90 guided hours of live teaching, supervised labs and an assessment
- Hacking Trainer course completion certificate
- You join the track batch when this course runs, with the track students, in Ameerpet or live online
- Paid in full at enrollment; installments are for the Offensive Security Track only
- Refund before the batch starts or in the first 5 class days, less a ₹1,000 processing fee
Most breaches of modern software come from a handful of ideas applied patiently: broken access control, weak sessions and tokens, injection, and trust placed in the client. The same ideas break websites, the APIs behind them, Android apps and the desktop software many companies still run. This course teaches the method behind testing all four, in authorized labs, rather than a list of payloads to memorize.
You start with Burp Suite and the web and API risks in the OWASP lists, then test Android apps with jadx, MobSF and Frida, and thick-client applications with Sysinternals tools and .NET decompilers. One module adds secure code review and AI application security. You finish by assessing targets you have not seen before, building a coverage matrix, explaining false positives, fixing representative flaws and running a formal retest: the cycle clients pay for.
Course Overview
90 guided hours over 6 weeks in eight modules: mapping and test planning, authentication and access control, injection and server-side attacks, business logic and GraphQL, Android app pentesting, thick-client pentesting, secure code review and AI application security, ending in an assessment of unseen targets. You learn in a hands-on lab environment with instructor guidance, in our Ameerpet classroom or live online.
Application Security at a Glance
You Will Need
HTTP basics, basic HTML and JavaScript, and Linux or Windows command-line basics. A short admissions check confirms your starting point.
Outcome
Test web applications, APIs, Android apps and thick-client applications by method, and produce reviewed reports with fixes.
Lab Tools
Burp Suite, OWASP ZAP, Postman, ffuf, SQLmap, Semgrep, the Android emulator and ADB, jadx, apktool, MobSF, Frida, objection, Sysinternals Process Monitor, dnSpyEx or ILSpy, Wireshark and an intentionally vulnerable AI chat assistant.
What You Will Learn
- Map an application and its APIs with Burp Suite, and plan a test with an endpoint-and-role coverage matrix
- Break authentication, sessions, JWT and OAuth, and find IDOR, BOLA, mass-assignment and function-level flaws
- Find and exploit injection, XSS, file-handling, SSRF and XXE issues in authorized labs, and explain the fix
- Test an Android app: static analysis with jadx and MobSF, insecure storage and components, and pinning and root-detection bypass with Frida
- Assess a thick-client application: traffic, local storage, .NET decompilation and DLL hijacking
- Review code for security flaws, use SAST and DAST with judgment, and test AI features against the OWASP Top 10 for LLM Applications
- Assess unseen targets, report with a coverage matrix and verify fixes in a formal retest
Curriculum: 90 Hours in 8 Modules
Course code HTA-101. Each module lists what you will be able to do, the topics, the hands-on labs, what you hand in and the job skills it covers. Open a module to see it.
HTA-101 · M1 Web Architecture, Mapping and Test Planning
9 h
Outcome: Map an application and its APIs completely, and plan a test that covers every role, endpoint and risk category.
Topics
- HTTP and HTTPS, TLS, cookies, headers, the same-origin policy and CORS basics
- Burp Suite set-up: proxy, scope, site map, Repeater and Intruder
- Content discovery with ffuf, and reading client-side JavaScript
- REST, SOAP and GraphQL; OpenAPI and schemas; building an API inventory
- Standards: OWASP Top 10:2025, OWASP API Security Top 10:2023, WSTG and ASVS
- Engagement scope, rules of engagement and the endpoint-and-role coverage matrix
Hands-on labs
- Map a multi-role web application and its API
- Build the coverage matrix you will use all course
Deliverable
Application map and coverage matrix
Job skills covered
- Burp Suite
- OWASP Top 10
- API testing
- Test planning
HTA-101 · M2 Authentication, Sessions and Access Control
12 h
Outcome: Break login, session and permission controls, including the object, property and function-level flaws most common in APIs.
Topics
- Authentication, MFA and password-reset flows; session handling and logout
- JWT handling, OAuth 2.0 and OpenID Connect
- Horizontal and vertical access control; IDOR and BOLA
- Mass assignment and property-level authorization (BOPLA); function-level authorization (BFLA)
- Multi-role and multi-tenant testing
- CSRF, CORS misconfiguration and clickjacking
Hands-on labs
- Two-account access-control testing across the coverage matrix
- Forge and tamper with JWTs in a vulnerable API
Deliverable
Access-control findings with evidence
Job skills covered
- Authentication testing
- Access control (IDOR, BOLA)
- JWT and OAuth
HTA-101 · M3 Injection and Server-Side Attacks
12 h
Outcome: Find, confirm and explain injection and server-side flaws, and show developers exactly how to fix them.
Topics
- SQL injection, including careful use of SQLmap; NoSQL injection
- OS command injection, server-side template injection and insecure deserialization
- Cross-site scripting (reflected, stored and DOM-based) and Content Security Policy
- File upload, path traversal and file inclusion
- XXE, and SSRF including cloud metadata services
Hands-on labs
- Exploit each class in authorized labs, then write the fix
- Chain SSRF to reach an internal service
Deliverable
Injection findings with reproduction steps and fixes
Job skills covered
- SQL injection
- XSS
- SSRF
- Server-side vulnerabilities
HTA-101 · M4 Business Logic, Advanced Web Attacks and GraphQL
9 h
Outcome: Test what scanners cannot: business workflows, race conditions, request-level attacks and GraphQL APIs.
Topics
- Business logic and sensitive workflows; limits, quotas and resource consumption
- Race conditions and state transitions
- Host-header attacks, request smuggling, cache poisoning and cache deception
- WebSockets and client-side prototype pollution
- GraphQL: introspection, resolver-level authorization, batching and query depth
Hands-on labs
- Exploit a race condition in a checkout flow
- Test a GraphQL API
Deliverable
Business-logic and GraphQL findings
Job skills covered
- Business-logic testing
- GraphQL
- Advanced web attacks
HTA-101 · M5 Android Application Penetration Testing
15 h
Outcome: Test an Android app end to end: unpack and read it, find insecure storage and components, bypass client-side controls and test its back-end API.
Topics
- Android architecture, the APK format, permissions and the app sandbox
- Lab set-up: Android emulator, ADB and a rooted test device image
- OWASP Mobile Top 10 (2024), MASVS and MASTG
- Static analysis with jadx, apktool and MobSF: hardcoded secrets, insecure configuration and weak cryptography
- Insecure data storage: shared preferences, databases, logs and backups
- Exported activities, services, content providers, intents, deep links and WebViews
- Intercepting app traffic with Burp; certificate pinning and root-detection bypass with Frida and objection
- Testing the mobile back-end API
Hands-on labs
- Assess intentionally vulnerable Android apps in an emulator
- Bypass certificate pinning and test the app's API
Deliverable
Android application penetration test findings
Job skills covered
- Android application security
- OWASP MASVS
- Frida
- Mobile API testing
HTA-101 · M6 Thick-Client Application Penetration Testing
10 h
Outcome: Assess a desktop application and its server: traffic, local storage, binaries and the Windows environment it runs in.
Topics
- Two-tier and three-tier thick-client architectures; .NET and Java desktop applications
- Information gathering with Sysinternals tools such as Process Monitor
- Intercepting HTTP and non-HTTP traffic between the client and its server
- Insecure local storage: configuration files, the registry, hardcoded credentials and database connection strings
- Decompiling .NET applications with dnSpyEx or ILSpy, and patching client-side checks
- DLL hijacking and insecure file and service permissions
- Direct database access and injection through the client
- OWASP Desktop App Security Top 10
Hands-on labs
- Assess an intentionally vulnerable thick-client application end to end
Deliverable
Thick-client assessment findings
Job skills covered
- Thick-client testing
- Binary analysis basics
- .NET decompilation
HTA-101 · M7 Secure Code Review, DevSecOps and AI Application Security
11 h
Outcome: Read code for security flaws, use SAST and DAST tools with judgment, and test AI features for prompt injection and data leaks.
Topics
- Threat modeling with STRIDE
- Secure code review basics: spotting injection and authorization flaws in code
- SAST with Semgrep and DAST with OWASP ZAP and Burp's scanner; dependency and secrets scanning
- How chat assistants, RAG and agents sit behind web and API endpoints
- OWASP Top 10 for LLM Applications 2025: prompt injection, improper output handling, sensitive information disclosure and excessive agency
- AI-assisted testing: payload ideas and report drafting, verified by hand
Hands-on labs
- Review a vulnerable code base and confirm the flaws in the running app
- Attack an intentionally vulnerable chat assistant with a knowledge base and tools
Deliverable
Code-review notes and AI feature test notes
Job skills covered
- SAST and DAST
- Secure code review
- AI and LLM security
HTA-101 · M8 Capstone Assessment
12 h
Outcome: Assess unseen targets against the clock, report them professionally and verify the fixes in a formal retest.
Topics
- Assess an unseen web application and its API, plus an Android app or a thick-client application
- CTF challenges on web, API and mobile flaws
- Complete coverage matrix and an explanation of false positives
- Fix representative flaws, report and run a formal retest
- Technical oral exam on your findings
Hands-on labs
- Timed practical assessment and retest
Deliverable
Web, API, Android and thick-client reports (R-01 to R-04)
Job skills covered
- End-to-end application security testing
- Report writing
Hours are guided hours and include supervised practice. Topics marked introduction or demonstration are not full hands-on units. Ask a counselor for the dated syllabus for your batch, or see how the syllabus maps to what employers ask for.
How This Course Runs
The Offensive Security Track is two 6-week courses: Application Security, then Network and Active Directory (advanced). Each runs its own batches. Application Security is weeks 1 to 6 of the track (application security); you join a batch with the same classes, labs and assessment as the track students sitting beside you.
The course lasts 6 weeks, 3 hours a day, Monday to Friday. Join in the Ameerpet classroom or live online. Start dates are on the upcoming batch schedule. A weekend batch also runs on Saturday and Sunday, 10 AM to 2 PM IST, over about 12 weekends.
This Course, or the Full Track?
Application Security is a good fit if you want this one skill in depth. For the full penetration testing path, the Offensive Security Track adds Network and AD (Advanced) to it, for less than the two courses cost separately.
- 6 weeks, 90 guided hours
- Application Security, Network and AD (advanced), or SOC and DFIR
- Assessment, reports and a Hacking Trainer certificate
- Ameerpet classroom or live online
- Both courses: Application Security, then Network and AD
- 12 weeks, 180 supervised hours
- Six assessed reports and a lab you keep
- Interview preparation (no placement promise)
- Saves ₹10,000 + GST on two courses
| What you get | Application Security course | Offensive Security Track |
|---|---|---|
| Fee | ₹20,000 + 18% GST (₹23,600 in total) | ₹30,000 + 18% GST (₹35,400 in total), against ₹40,000 + GST for the two courses bought separately |
| Duration | 6 weeks, 3 hours a day, Monday to Friday | 12 weeks, 3 hours a day, Monday to Friday |
| Guided hours | 90 | 180 supervised hours |
| What it covers | This skill, in depth | Application security (web, API, Android, thick client), then advanced network and Active Directory testing |
| Reports | The assessment reports for this course | Six assessed reports |
| Interview preparation | Included | Resume and LinkedIn review and mock technical interviews. No job placement or placement assistance |
| Try first | 3 to 5 real classes free | 3 to 5 real classes free |
Who Should Join
- Aspiring application and mobile penetration testers
- Developers and backend engineers
- QA engineers moving into security testing
- AppSec analysts
Start Dates and Mode
Start dates for every course are on one page: the upcoming batch schedule. Join in the Ameerpet classroom or live online. Your seat is confirmed in writing before you pay, and refunds follow our refund and cancellation policy.
Where You Will Learn
A real training room near Ameerpet Metro, open 7 days. Join in the room or live online: the classes, labs and assessments are the same. See the batch schedule.
Questions About Application Security
What does the course cover?
Web applications and APIs (REST, SOAP and GraphQL), Android apps and thick-client desktop applications, plus secure code review and AI application security, in eight modules over 6 weeks.
How much Android testing is there?
A 15-hour module: APK structure and the app sandbox, static analysis with jadx, apktool and MobSF, insecure storage and exported components, certificate pinning and root-detection bypass with Frida and objection, and testing the app's back-end API, mapped to the OWASP MASVS. iOS is not covered.
What is thick-client testing?
Testing desktop applications that talk to a server or database, common in banking and enterprise software. The 10-hour module covers traffic interception, insecure local storage and hardcoded credentials, .NET decompilation, DLL hijacking and injection through the client.
Is OWASP covered?
Yes. The modules map to the OWASP Top 10:2025, the API Security Top 10:2023, the Mobile Top 10, MASVS and MASTG, the Desktop App Security Top 10 and the Top 10 for LLM Applications, and you map your coverage to them in the assessment.
Is it part of the Offensive Security Track?
Yes. It is weeks 1 to 6 of the track, followed by the advanced Network and Active Directory course. You can also take it on its own.
Do I need to know hacking first?
No, but you need HTTP basics, basic HTML and JavaScript, and command-line basics. A short admissions check confirms your starting point.
Are there CTF challenges in the Application Security course?
Yes. Every student in every course gets CTF challenges on the month's topics, run in the lab, alongside the course assessment.
What credential do I receive?
You receive a Hacking Trainer course completion certificate. It is issued by Hacking Trainer and is not an EC-Council or other vendor certification.
How much does the Application Security course cost?
₹20,000 + 18% GST (₹23,600 in total). Refunds follow our refund and cancellation policy; an exam voucher cannot be refunded once we have bought it.
When does the Application Security course start?
Each course runs its own batches. Application Security is weeks 1 to 6 of the track (application security), and you can join it on its own or as part of the track. The course lasts 6 weeks, 3 hours a day, Monday to Friday. Dates are on our upcoming batch schedule page.
Should I take this course or the full track?
Take this course if you want application security on its own. Take the Offensive Security Track if you want the full penetration testing path: it adds Network and AD (Advanced) for ₹30,000 + 18% GST (₹35,400 in total), against ₹40,000 + GST for the two courses bought separately.
Can I attend online?
Yes, in our Ameerpet classroom or live online. Confirm the mode of your batch when you inquire.
Student Guides
OWASP API Security Top 10 Explained for Beginners
The ten most serious API risks, from BOLA to unsafe consumption, in plain words.
Read the guide →Bug Bounty for Beginners in India: How to Start Safely
Skills to learn first, how to read scope, and how to write a good report.
Read the guide →Jobs, Courses and Certifications
Which cybersecurity job fits you, and the one course and certification that prepare for it.
Read the guide →Start the Application Security Course
Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.
- Call+91 86868 92922
Open 7 days: Mon to Fri 8:30 AM to 8:30 PM IST
Sat and Sun 10 AM to 6 PM IST - Emailinfo@hackingtrainer.com
- VisitGround Floor, G-3, Sri Venkatasai Nest, Kallu Compound Road, Nagarjuna Nagar Colony, Yella Reddy Guda, Ameerpet, Hyderabad – 500073
Open in Google Maps