Skip to main content

Hacking web-apps, with & without AI

OpenCampus Kiel course material. We break a deliberately vulnerable web shop (OWASP Juice Shop) by hand first, then see how AI pentesting agents do against the same target.

How the course works​

  • The course is built from units. A unit is not always exactly one session: we pick up where we stopped.
  • Every unit has the same shape: why it matters, theory, Juice Shop tasks, and homework with a short write-up.
  • Everything runs on your own machine (a Kali Linux VM or Docker). Only attack what the course tells you to, and nothing else.
  • New pages appear here as we reach them.

Units​

  • Intro and setup: what pentesting is, the rules, installing Kali and Juice Shop
  • Injection: tricking an application into running your input as a command
  • XSS: running your JavaScript in someone else's browser
  • Broken authentication and access control: coming later

Where we are​

Not started yet. First session: 10 November 2026.