Looking to learn web application testing, any pointers?

[Mindscrew]

Here is a site i have used in the past.

It is pretty good. It offers easy challenges and then some more advanced and difficult challenges.
There is a forum for support. They wont tell you how to solve the problems but they will give you reasonable hints if you get stuck.
Try it out.

Hack This Site!

[xelerated]

Maybe I'm missing something but I fail to see how a metasploit course is going to help him with Web Application testing.

That being said, I suggest you checkout:
- the Open Web Application Security Project (OWASP), they have a testing guide and other docs/projects that will be of use.
- WebGoat is a leaning app/tutorial for Web App security.
- SANS has a web applicaiton security course that might be of interest to you (GWAPT if I recall correctly)

Check:
Deliberately Insecure Web Applications For Learning Web App Security (WebGoat, BadStore, Hacme, SecuriBench, WebMaven)

I would recommend checking out the OSSTMM (ISECOM - Making Sense of Security) too!
Id recommend it be first on the list.. but im biased

[thorin]

Additional resources:

Tor sent in a link to a Google code page on Web Security. This page provides links to several good web app pen testing and defense resources. The most intriguing of which is the Jarlsberg codelab. Essentially Jarlsberg is a buggy web app that you can hack to learn web app pen testing and defense.

From the Jarlsberg introduction page:

"This codelab is built around Jarlsberg /yärlz'·bərg/, a small, cheesy web application that allows its users to publish snippets of text and store assorted files. "Unfortunately," Jarlsberg has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution. The goal of this codelab is to guide you through discovering some of these bugs and learning ways to fix them both in Jarlsberg and in general. "

Sounds like fun.

-- Rick Wanner - rwanner at isc dot sans dot org

SANS Internet Storm Center Diary 2010-05-06 Learn about web app hacking and defense