Penetration Testing Course in Maninagar, Ahmedabad

Penetration testing here means a report a developer can use: one lab API request, one weakness class, and the fix. If your BCA, BTech, or IT labs stopped at theory, we practise that report with you. At Computer Education And Cybernetics (CEC) a mentor reads it before it counts. The lab is ~2 minutes from Maninagar Railway Station.

Book counselingSee the report

Or reach us directly

+91 75740 10176 · info@cecyours.org

A remediation report, four lines

Lab API · checkout

  • ClassThe server trusted a value the browser sent
  • EvidenceThe request field, and the lab order that followed
  • ImpactWho is affected, inside the lab only
  • FixThe server must set that value itself
You practise on
Lab APIs we own
A proxy shows
The request the app sent
You leave with
A remediation report
You start with
Counseling

How does an API test become a remediation report?

You read one request on a lab API, name the one weakness class the result belongs to, and write the fix. We give you that API and a written scope before the proxy opens.

Web and API penetration testing means authorised testing of an application you were given: you read one request, show what the server trusted, map that result to one weakness class, and write a remediation report a developer can apply. The OWASP Top 10 is the public list those classes come from. A proxy such as Burp Suite is how you see the request. Computer Education And Cybernetics (CEC) teaches this on lab APIs and does not assign tests on public websites.

  • An API request is a message you can read

    A web API is a page’s way of asking the server to do something, such as place an order. The message has a path and a few fields. Penetration testing on an API starts when you can point at one field and say whether the server should have trusted it.

  • The proxy is where you read that message

    A web-testing proxy such as Burp Suite shows the request the lab app really sent. You read it. A paid Pro licence is not required to learn that, and we do not promise to supply one. The lab is the reading and the report, not a tour of buttons.

  • One weakness class, named in plain words

    The OWASP Top 10 is a public list of the weakness classes most often found in web applications. Your report names the one class this finding belongs to. Listing all ten without a lab result is not a test.

  • The remediation paragraph is the point

    A remediation report tells a developer what to change. You write the endpoint, the field, what the lab did, and the fix. A classmate who builds APIs should be able to apply the fix without repeating your test.

A task on paper first

Open one lab checkout request and circle the field the server should have decided itself. That circle is the line the report must explain, before you name a weakness class.

A worked example: the checkout trusted the browser’s price

The test is allowed because the shop API is ours. The skill is the paragraph a developer can apply.

  1. The scope

    You are allowed to test one lab shop API, and only its checkout. The written scope names that API. Anything else is out.

  2. The request

    Checkout sends an item and a price the page filled in. In the proxy you can see both. The catalogue price for that item is a different number from the one in a second lab request.

  3. The decision

    The server stored the order at the price in the request. It did not look up its own price. You stop. You do not try the same request on a live store, a college portal, or any API you were not given.

  4. The paragraph you hand over

    You name the checkout path, the price field, that the lab order total followed the request, and the fix: the server must set the price from its catalogue. You label the class in plain words: the design let the browser decide a value the server should decide. You do not attach a recipe for repeating the test.

An honest limit: this lab makes you accurate on one API and one class. Testing live companies, or working through every class on the public list, comes later and only with permission. Confirming a single web-page finding, before a full report, is the Maninagar ethical hacking lab. Scope and method for a whole engagement sit on the Ahmedabad penetration testing page.

Where are web and API tests heading?

Two changes are already in this work. You still write the fix from the request you saved, including when an assistant drafted the first paragraph. We ask you to point at that request, not at the draft.

  • Assistants draft the remediation paragraph

    The same lab request now comes back with a ready-made fix, a severity, and sometimes a second finding you never showed. The draft grew. The request you saved did not.

  • APIs are moving to short-lived tokens

    Login is less often a long-lived cookie and more often a token that expires. The server still has to check that the token belongs to the caller. A new token format does not remove that check.

Where an assistant still fails you

  • It writes a fix you cannot point to in the request you saved
  • It names several weakness classes when the lab showed one
  • It suggests a college portal, a public API, or a shop you were not given

Web and API testing is shifting as assistants draft remediation text and as logins move to short-lived tokens. The durable skill is showing one field the server trusted and writing a fix a developer can apply. CEC trains that paragraph in the lab. A generated severity does not replace it.

How we teach you to write a fix a developer can use

About 80% of our training is practical. A mentor reads the report the way a reviewer would: Does the fix match the request, and did you stay on the lab API?

  1. 1. Counseling places the lab against your syllabus

    BCA, BTech, and IT students often arrive with theory and no request they have read. Career changers who already build or support software start from the field they already know. School learners of any grade start with counseling before a course. After 12th anyone can apply, from any stream.

  2. 2. One lab API until the fix is specific

    You stay on an API we control. A mentor sends the report back when the fix is vague, when a weakness class is named without evidence, or when the test left the written scope.

  3. 3. The proxy, then the paragraph

    You read one checkout request, record what the server trusted, and write the fix a developer can apply. Across our centres we have conducted 20,000+ of training. This hour is that paragraph, not a list of tool menus.

  4. 4. An assistant may draft the wording

    You can ask it to phrase the fix. You then delete any sentence you cannot point to in the request, the lab order, or the class you actually showed.

Computer Education And Cybernetics (CEC) teaches this API report inside the Cyber Security and Ethical Hacking with AI course. You start with counseling, read one lab request, name one weakness class, and leave with a remediation paragraph a mentor can recheck. We stay with you until you get a job, based on your performance.

This lab is part of our Cyber Security & Ethical Hacking with AI course, not a separate product. The Ahmedabad penetration testing page describes the wider method.

Placement support and certificates

The remediation report is the proof you can show. We help you put it in a portfolio, then we stay with you for the job search.

How we stay with you

  • We stay with you until you get a job, based on your performance in training, projects, and interviews
  • Our 5-step placement preparation covers your resume, the remediation report, communication, and mock interviews
  • The report — the request, the class, and the fix — is what you can show a reviewer
  • Course completion certificates are issued after you finish the practical requirements

More detail on placement support at CEC.

Which weakness class does this finding belong to?

These four names are enough to label a first lab. You write one of them only when the request showed it. BCA, BTech, and IT students use the label to connect a syllabus term to a fix. Career changers use the same paragraph to show they can explain a change, not only find a fault.

  • Broken access control

    One account can open a record that belongs to someone else. You name this only when the lab showed that record.

  • Injection

    The server treats something you typed as a command. You describe what was treated as a command. You do not paste a sample command into the report.

  • Authentication failures

    A missing or mismatched login token is accepted. The evidence is the request that should have been rejected.

  • Insecure design

    The browser is allowed to set a value the server should set, such as a price. That is the class for the checkout lab.

How you reach the Maninagar lab

CEC Maninagar is ~2 minutes from Maninagar Railway Station, on the 2nd floor of Gopal Tower. BRTS, AMTS both serve this side of the city. Visiting is optional — counseling by phone comes first.

Gopal Tower

2nd floor, Gopal Tower, Computer Education And Cybernetics, near Maninagar Railway Station Road, Maninagar, Ahmedabad, Gujarat 380008. Call +91 75740 10176 before you travel so we can confirm the day.

  • Mon – Sat: 8:45 AM – 7:15 PM
  • Sun: 10:00 AM – 6:00 PM
  • CEC Maninagar at Gopal Tower near Maninagar Railway Station
  • CEC Maninagar computer lab

Who reviews the report here

  • Nayan Nathani

    Software Faculty · 2+ years

    Teaches Data Analytics and Cyber Security. In this lab, the review is whether the fix matches the request you saved and whether you stayed on the lab API.

Our three centres in Ahmedabad

This lab is at Maninagar. Nikol and Vatva are available when counseling places you there. Visiting any centre is optional.

Related guides

Questions before a web and API lab

If your course named security and never showed you a request, bring that to counseling.

  • How does web and API penetration testing work in this lab?

    You test only an application programming interface you were given, on a lab app Computer Education And Cybernetics (CEC) controls. You read one request in a proxy, decide whether the server trusted a field it should have checked, and write a remediation report: the evidence, one weakness class, and the fix. You do not move on to a second target.

  • What is a remediation report?

    It is a short note a developer can use. It names the lab endpoint, the field the server trusted, what the lab did as a result, the weakness class in plain words, and the change the server should make. A list of tool names is not a report. The report is finished when someone else could apply the fix without repeating your test.

  • What does the OWASP Top 10 list mean here?

    It is a public list of the weakness classes most often found in web applications, such as broken access control, injection, authentication failures, and insecure design. You attach one class to a finding you actually showed. Naming all ten without evidence is not the lab.

  • Do I need Burp Suite Pro?

    No. You need to read the request a lab app sends. We use a web-testing proxy such as Burp Suite for that. A paid Pro licence is not required, and we do not promise to provide one.

  • Will I be testing live websites, college portals, or company APIs?

    No. Labs use APIs CEC controls. A college portal, a public website, or a shop you were not given is out of scope, including when an assistant suggests it.

  • Where is API testing heading?

    Assistants already draft remediation text, sometimes with a finding you did not show. Login is also shifting toward short-lived tokens. The work that stays valuable is checking that the server still decides the sensitive value, and writing only the fix you can point to in the request.

  • How does CEC help me practise this?

    You read one lab checkout request, name one weakness class, and rewrite the fix until a mentor can follow it. About 80% of training time is practical. Counseling decides whether you start with the request itself or with how an API message is shaped. The practice sits inside our Cyber Security and Ethical Hacking with AI course.

  • I am in BCA, BTech, or IT. Is this the right start?

    If your labs stopped at theory, counseling starts you on one lab API and a report, not on a list of tool names. Career changers who already write or support software use the same report. You do not need a prior testing background. You do need to write the fix in words a developer can apply.

  • How do I reach the Maninagar lab?

    CEC Maninagar is ~2 minutes from Maninagar Railway Station, on the 2nd floor of Gopal Tower. BRTS, AMTS both serve the area. Learners also come from Kankaria, Isanpur, Ghodasar, Khokhra, Meghaninagar, Danilimda. The centre is at 2nd floor, Gopal Tower, Computer Education And Cybernetics, near Maninagar Railway Station Road, Maninagar, Ahmedabad, Gujarat 380008. Call +91 75740 10176 before you visit.

  • Can I start without visiting Maninagar?

    Yes. Counseling is by call, WhatsApp, or email on +91 75740 10176 or info@cecyours.org. Visiting the lab is optional. If another Ahmedabad centre is easier, say so in counseling and we will place you where the same practice fits.

Write the fix for one lab API, then stop

Tell us whether you are in BCA, BTech, IT, or changing into this work. We will start you on the request or on foundations — and the lab stays on APIs we own.

Book counseling

Or reach us directly

+91 75740 10176 · info@cecyours.org