Personal Web Pentesting Lab

Personal cybersecurity lab used to reproduce common web vulnerabilities, understand the exploitation path, and connect testing to defensive recommendations.

Date2025-01-12

CategoryPersonal

RoleLab setup, testing, analysis, and documentation

StackKali Linux • Burp Suite • PHP • MySQL • Manual testing

CybersecurityPentestingWeb securityBurp SuiteKali LinuxPHP / MySQL

Key highlights

Built the lab as a learning environment, not as a checklist of tool usage.
Connected offensive testing to practical recommendations instead of stopping at vulnerability reproduction.
Used the project to strengthen curiosity, evidence gathering, and disciplined write-ups.

ContextPersonal lab outside formal coursework

FocusXSS, SQL injection, and insecure file upload scenarios

GoalLearn through reproduction, observation, and defensive recommendations

What I handled

Set up isolated web targets with simple PHP/MySQL logic so each vulnerability mechanism stayed understandable and testable.

Used Burp Suite and manual request inspection to follow input handling, parameter behavior, and the impact of insecure controls.

Documented the exploitation path for issues such as XSS, SQL injection, and file upload weaknesses before switching to remediation thinking.

Turned each test into defensive recommendations instead of presenting the lab as a purely offensive exercise.

Results & evidence

Vulnerability scopeXSS + SQLi + uploadThe lab focused on a small set of high-learning-value issues rather than spreading too wide too early.

Observation proofRequests inspectedBurp Suite and manual testing were used to observe the full request or response path.

Analysis proofMechanism explainedEach reproduced weakness was tied back to why the control failed.

Defensive outputRecommendations addedThe lab always ends with mitigation logic, not only exploitation.

Lab architecture

Diagram of the personal web pentesting lab showing Kali, Burp, PHP application, MySQL, and remediation notes. — This architecture image keeps the lab readable and makes the test flow visible without pretending to be a production-grade environment.

Timeline

Step 1

Build the vulnerable environment

Prepare simple web targets and an isolated workflow where common weaknesses can be reproduced safely.

Step 2

Test and observe

Use manual testing and tools such as Burp Suite to inspect requests, inputs, and exploitation paths.

Step 3

Document and connect to defense

Turn the observations into clearer security understanding and practical recommendations.

Overview

This project is a personal web pentesting lab built to understand common web vulnerabilities through direct experimentation. The goal is not to claim an advanced offensive-security role, but to develop a solid habit of testing, observing, and documenting security weaknesses correctly.

What I worked on

Reproducing common issues such as XSS, SQL injection, and insecure file upload
Using Burp Suite and Kali Linux to inspect requests and behavior
Linking technical tests to more defensive questions: what failed, why it failed, and what should be improved

Why it matters in my portfolio

This project is useful because it shows a real cybersecurity learning dynamic:

curiosity backed by hands-on testing
ability to reproduce weaknesses instead of discussing them only in theory
connection between analysis and remediation
habit of documenting what was observed

Technical angle

The lab relies on simple web targets so that the vulnerability logic stays understandable. That matters because the goal is to learn the mechanisms clearly, not to hide weak understanding behind complicated tooling.

Current proof included on the page

a simple lab architecture image that shows the target, the test workstation, and the analysis flow
an evidence board summarizing what was tested and how the lab leads to remediation notes
a block describing what I personally handled instead of hiding behind generic wording
result cards that make the project look like an actual learning lab with outputs

What this project demonstrates

early practical exposure to web application security
disciplined observation of requests and inputs
growing comfort with security tooling
a mindset that values technical evidence and structured notes

What can still be added later

This page can later include request examples, sanitized findings, and selected screenshots from the lab tools.

Evidence board

Validation board for the personal web pentesting lab — The board shows the current proof layer of the project: test focus, observation path, and defensive output.