THE PENTEST LAB
Home / Tutorials / VAPT / What Is VAPT?
VAPT FUNDAMENTALS · LESSON 01

What Is VAPT? Vulnerability Assessment & Penetration Testing

Learn how professional pentesters identify security weaknesses, verify their impact, and help organizations protect their websites, applications, and networks.

Beginner Friendly Real-World Examples DVWA VAPT Career

1. What Is VAPT?

VAPT stands for Vulnerability Assessment and Penetration Testing. It is a security testing process used to identify weaknesses and evaluate the risks they create.

🔎 Vulnerability Assessment (VA)

Finds and prioritizes possible weaknesses in applications, servers, and networks.

Main question: What security problems might exist?

🛡️ Penetration Testing (PT)

Uses controlled, authorized security tests to verify weaknesses and understand their impact.

Main question: Can this weakness be exploited, and what could happen?

How VAPT Helps Improve Security
Website / System
→
Find Weaknesses
→
Verify Risk
→
Report & Fix
Remember: VAPT is not simply running a scanner. Professional testing includes planning, manual verification, documentation, remediation, and retesting.

2. Vulnerability Assessment vs Penetration Testing

Feature Vulnerability Assessment Penetration Testing
Purpose Identify potential weaknesses Verify exploitability and impact
Approach Scanning, configuration review, manual checks Manual testing and controlled exploitation
Example Find an outdated application component Check whether a weakness can actually be exploited
Output List of findings and priorities Verified evidence, impact and recommendations
Simple difference: VA identifies possible problems. PT investigates whether those problems can be exploited under the agreed testing conditions.

3. Real-World Example: E-Commerce Website

Imagine a fictional shopping website selling wireless headphones for ₹1,000.

A customer adds the product to their cart. During checkout, the browser sends information to the server. What if someone changes the submitted price to ₹100?

🎧

Wireless Headphones

₹1,000

Correct product price

Interactive Price Validation Demo

The browser submits a modified price of ₹100.

Select an option to see how the fictional server responds.
How Price Validation Should Work
Customer Browser
→
Application Server
→
Trusted Product Price
→
Checkout Decision

Illustrative HTTP Request

The following request is a simplified example. Real applications may send different parameters or calculate the price entirely on the server. 

POST /checkout HTTP/1.1
Host: shop.example.test
Content-Type: application/x-www-form-urlencoded

product_id=101&quantity=1&price=100

A secure application should calculate the payable amount using trusted server-side product data rather than accepting an untrusted price from the browser.

Security concept: If the server accepts unauthorized price changes, this may be a business logic vulnerability. Test such behavior only in an authorized environment.

4. Practical Example: Understanding DVWA

DVWA (Damn Vulnerable Web Application) is an intentionally vulnerable application used to practice web security testing in a controlled environment.

For this introductory lesson, we will simply observe how a web application accepts input and returns information. We are not exploiting anything yet.

● ● ●   Local DVWA — Simplified Illustration
DVWA MENU
Home
DVWA Security
SQL Injection
XSS
File Upload
Command Injection

SQL Injection

Enter a User ID:

1 Submit
Example Response
User ID: 1
First name: Example
Surname: User
What Happens When User ID 1 Is Submitted?
User Enters ID 1
→
Web Application
→
Database Query
→
User Details

What to Show in Your YouTube Video

  1. Open your already-running local DVWA application.
  2. Show the main dashboard and available vulnerability categories.
  3. Open the SQL Injection section.
  4. Enter the normal value 1 and click Submit.
  5. Explain the returned information and request-response flow.
Important: A normal database lookup does not prove SQL injection. Vulnerability testing will be covered in a separate practical lesson.

5. How a Professional VAPT Assessment Works

A real pentester follows an agreed methodology. Testing begins with authorization and ends with reporting and verification of fixes.

01

Authorization & Scope

Confirm written permission, allowed targets, testing dates and restrictions.

02

Reconnaissance

Identify application features, endpoints, technologies and exposed services.

03

Security Testing

Test relevant security controls and safely verify possible vulnerabilities.

04

Evidence & Risk

Record reproduction steps, affected assets, evidence and business impact.

05

Reporting

Write clear findings, severity ratings and actionable remediation guidance.

06

Retesting

Check whether the implemented fixes resolve the reported weaknesses.

6. What Does a Pentester Actually Do at Work?

Imagine you join a cybersecurity company as a junior VAPT analyst. Your team is assigned to assess a client's e-commerce application.

Your Typical Responsibilities

  1. Read the project scope and rules of engagement.
  2. Understand the application and its user roles.
  3. Configure Burp Suite and prepare test accounts.
  4. Map important features such as login, cart and checkout.
  5. Test authentication, authorization, inputs and business logic.
  6. Document confirmed findings with clear evidence.
  7. Explain severity, business impact and remediation.
  8. Submit your findings for review and help retest fixes.
Career takeaway: A professional pentester must do more than find bugs. They must understand scope, communicate clearly, produce reliable evidence, and recommend practical fixes.

7. Key Takeaways

VA Identifies

Discover and prioritize possible security weaknesses.

PT Verifies

Test weaknesses safely and evaluate their real impact.

VAPT Documents

Record evidence, severity and remediation recommendations.

VAPT Improves Security

Help developers fix vulnerabilities and verify the results.

Whether you want to work in VAPT or participate in bug bounty programs, these fundamentals will help you develop a structured security testing approach.

Continue Learning

In the next VAPT lesson, we will explore how a professional penetration testing project works from client authorization to the final report.

Related Tutorial: Website Information Gathering →
Learn how to identify and document the attack surface of a web application.

Next planned lesson: How a Real Penetration Test Works.