Cyber Defence
CYBERDEFENCE
The OWASP Top 10 attacked in a lab and then fixed in code — the core skill behind most security jobs. · Live online across Meghalaya

Web Security Course in Meghalaya

Web application security is the foundation of almost every offensive security job in India. This track works through the OWASP Top 10 by hand: how HTTP, sessions and browsers really behave, then broken access control, injection, XSS, SSRF, deserialisation, authentication flaws and business logic — each exploited in a lab and then fixed in code, so you understand attack and defence together.

Last updated: 6 August 2026

Book a free counselling call +91 75175 72000

What this track will not do for you

Scanner output is not a penetration test. After this track you can competently assess a typical business web application, but complex modern stacks — SSO federation, microservices, cloud IAM, custom cryptography — will still be beyond you. Expect an entry-level role and about a year on real applications before anyone calls you senior.

Who this is for

The right first specialisation for students, developers and career switchers heading toward pentesting, bug bounty or application security. Not the right choice if you want network, infrastructure or SOC monitoring work first, or if you expect a scanner to find everything — the serious findings here all come from manual testing.

Prerequisites: Basic understanding of how websites work — HTML, forms, a little JavaScript — and any exposure to a backend language or database is a bonus rather than a requirement. No prior security knowledge needed; HTTP, cookies and sessions are built from the ground up. A laptop able to run Burp Suite and a Docker lab is required.

The picture in Meghalaya

Meghalaya rests on agriculture and horticulture — Khasi mandarin, potato, ginger, turmeric and areca nut — plus limestone and cement in the Jaintia hills, and tourism. Shillong is the service centre: colleges, hospitals, hotels and government offices. Community-run homestays around Cherrapunji, Mawlynnong and Dawki have become a real rural income stream. Tura anchors the Garo hills as a separate commercial cluster.

Shillong has decent broadband and ordinary UPI use; Tura and the district towns are workable; deep Khasi, Jaintia and Garo hill villages still see weak signal, and the terrain makes fixed lines expensive to lay. English is the working language online, which removes a translation burden entirely. Most homestay owners currently handle bookings through WhatsApp and Instagram messages.

Sectors hiring for this in Meghalaya

Tourism & hospitalityHorticulture & agro-processingLimestone & cementEducation & healthcareHandicrafts & handloom

Main centres: Shillong · Tura · Jowai · Nongstoin · Baghmara

Web Security Course syllabus

8 weeks · 48 hours (live online, or at the Hisar campus). Every module is hands-on — you work on your own machine from Meghalaya, never against systems you do not own.

01. How the web really works

  • HTTP methods, status codes and the headers that matter
  • Cookies, session management and token storage choices
  • Same-origin policy, CORS and what actually blocks an attack
  • TLS basics and certificate handling
  • Browser dev tools plus Burp proxy configuration

02. Broken access control and authentication

  • IDOR across users, roles and tenants
  • Forced browsing and hidden administrative functionality
  • JWT flaws, session fixation and logout handling
  • Password reset and 2FA bypass patterns
  • OAuth and SSO misconfiguration basics

03. The injection family

  • SQL injection: error-based, union, blind and time-based
  • sqlmap with restraint, and manual verification first
  • NoSQL and ORM-layer injection
  • OS command injection and argument injection
  • Server-side template injection

04. Client-side attacks

  • Reflected, stored and DOM-based XSS
  • DOM sinks in React, Angular and Vue applications
  • Content Security Policy and realistic bypasses
  • CSRF where SameSite is not enough
  • Clickjacking and UI redress in a real user context

05. Server-side and logic flaws

  • SSRF including cloud metadata and internal service access
  • XXE and unsafe XML parsing
  • File upload, path traversal and object storage exposure
  • Insecure deserialisation across common stacks
  • Race conditions and price, quantity or workflow abuse

06. Fixing, retesting and reporting

  • The correct fix for each vulnerability class, in code
  • Input validation versus output encoding, and why the difference matters
  • Security headers that help and ones that are theatre
  • Retesting methodology and regression checks
  • Severity rating and a client-ready penetration test report

Tools used

Burp Suite CommunityOWASP ZAPsqlmapffufNiktoNucleiOWASP Juice ShopDVWA and bWAPPPostmanDockerBrowser developer tools

Where this leads

RoleTypical band
Web Application Penetration Testerroughly ₹3.5–8 LPA range
Application Security Analystroughly ₹4–9 LPA range
Secure Code Reviewer / Security-minded Developerroughly ₹4–10 LPA range
VAPT Consultantroughly ₹4–9 LPA range

Salary bands are indicative ranges across India and vary widely with skill, city and employer. Public aggregators disagree considerably on specialist roles, so treat any single figure — including these — as a range, not a promise. We do not guarantee placement.

Fees

These are our published course fees. Specialist tracks like the web security course are quoted on the counselling call, because the right scope depends on what you already know — we will not sell you six months of content to teach you something you can cover in six weeks.

Cyber Security Course3–4 months₹15,000
Ethical Hacking Course (CEH-aligned)6 months₹60,000
Digital Forensics2 months / 35 hours₹10,999
CCNA Networking2 months / 45 hours₹8,999

EMI available. No separate lab, material or certificate charges. Vendor exam vouchers (EC-Council, OffSec, CompTIA, AWS, Microsoft) are bought from the vendor — we do not resell them.

Web Security Course in Meghalaya — FAQs

Is the Web Security Course worth doing from Meghalaya?

▾
Web application security is the foundation of almost every offensive security job in India. This track works through the OWASP Top 10 by hand: how HTTP, sessions and browsers really behave, then broken access control, injection, XSS, SSRF, deserialisation, authentication flaws and business logic — each exploited in a lab and then fixed in code, so you understand attack and defence together. Locally, Shillong has decent broadband and ordinary UPI use; Tura and the district towns are workable; deep Khasi, Jaintia and Garo hill villages still see weak signal, and the terrain makes fixed lines expensive to lay. The employers who value this here sit in tourism & hospitality, horticulture & agro-processing, limestone & cement. Classes are live online, so where in Meghalaya you live changes nothing about the teaching, the labs or the certificate.

What do I need to know before starting?

▾
Basic understanding of how websites work — HTML, forms, a little JavaScript — and any exposure to a backend language or database is a bonus rather than a requirement. No prior security knowledge needed; HTTP, cookies and sessions are built from the ground up. A laptop able to run Burp Suite and a Docker lab is required.

What will this NOT do for me?

▾
Scanner output is not a penetration test. After this track you can competently assess a typical business web application, but complex modern stacks — SSO federation, microservices, cloud IAM, custom cryptography — will still be beyond you. Expect an entry-level role and about a year on real applications before anyone calls you senior.

Should I take this before the bug bounty course?

▾
Yes, in almost every case. Bug bounty assumes you already recognise vulnerability classes and can test them by hand. Hunters who skip fundamentals spend months submitting duplicates and invalid reports. Do web security first, then apply it on live programs with the bug bounty track.

Coding aani chahiye kya web security seekhne ke liye?

▾
Shuruaat ke liye zaroori nahi — HTML aur thodi si JavaScript samajh aati ho to kaafi hai. Lekin jaise jaise aage badhoge, PHP, Python ya JavaScript padhna aana bahut madad karta hai, khaas kar fixing wale module me. Hum har vulnerability ka fix bhi code me dikhate hain.

Do you teach how to attack real websites?

▾
We teach on deliberately vulnerable labs — Juice Shop, DVWA, bWAPP and our own targets — because attacking a website you do not own is an offence under the IT Act, whatever your intention. Once you are ready, we point you to legitimate public programs where testing is explicitly permitted.

How does this differ from your main ethical hacking course?

▾
The ethical hacking flagship is six months and spans networks, systems, wireless, web and reporting. This track is eight weeks and goes deeper on web alone. Take this if web application security is specifically where you want to work, and the flagship if you want broad coverage first.

We have no office in Meghalaya

Cyber Defence has one campus — Red Square Market, Hisar, Haryana 125001 — and teaches Meghalaya live online. We do not list addresses we do not have, we publish no star ratings because we have no verified review corpus, and we do not guarantee placement.

We issue a Cyber Defence certificate with a public verification link. We are not an authorised training centre for EC-Council, OffSec, CompTIA, AWS or Microsoft, and we do not resell their exam vouchers.

Ask whether this track is right for you

Free call with Amit Kumar. If a shorter track or a different starting point suits you better, that is what you will hear.

Call +91 75175 72000