# Introduction to Web Applications

> Web application fundamentals for penetration testing. HTTP basics, technology fingerprinting, content discovery, CMS detection, and Burp Suite as intercepting proxy.

- **URL:** https://hackindex.io/learn/oscp-pen-200-study-path/introduction-to-web-applications
- **Certification:** [OSCP (PEN-200) Study Path](https://hackindex.io/learn/oscp-pen-200-study-path.md)
- **Estimated study hours:** 1
- **Published:** 2026-09-23
- **Updated:** 2026-09-25

Before attacking web applications, you need to understand how they work. This module covers the fundamentals: HTTP request and response structure, common web technologies, content management systems, and the tools used to inspect and map web application attack surfaces. Burp Suite is your primary proxy for all web testing in PEN-200.

## Web Technology Identification

Fingerprint the web stack before testing. Server software, frameworks, CMS platforms, and programming languages each have their own set of known vulnerabilities and attack patterns.

## Web Application Mapping

Discover content, endpoints, virtual hosts, and parameters. Directory brute-forcing, crawling, and API enumeration build the map you test against. Burp Suite ties it all together as an intercepting proxy for manual inspection and repeating requests.

## Study material

- [HTTP Tech Fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting.md) (read, core)
- [HTTP Header Analysis](https://hackindex.io/services/web/enumeration/http-header-analysis.md) (read, core)
- [CMS Detection and Fingerprinting](https://hackindex.io/services/web/enumeration/cms-detection.md) (read, core)
- [Web Content Discovery](https://hackindex.io/services/web/enumeration/content-discovery.md) (read, core)
- [Web Crawling and Spidering](https://hackindex.io/services/web/enumeration/web-crawling.md) (read, core)
- [Virtual Host Enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration.md) (read, core)
- [API Endpoint Enumeration](https://hackindex.io/services/web/enumeration/api-endpoint-enumeration.md) (read, core)
- [HTTP Parameter Crawling and Discovery](https://hackindex.io/services/web/enumeration/parameter-crawling.md) (read, core)
- [Burp Suite](https://hackindex.io/services/web/enumeration/burp-suite.md) (read, core)
- [Login Page Enumeration](https://hackindex.io/services/web/enumeration/login-page-enumeration.md) (read, core)