In the previous lesson you chose, according to your profile, which appsec certification to aim for, and one idea became clear: good web security credentials are passed by practicing, not memorizing. This lesson -the last of the course- gives you exactly that: an executable study plan with the best free, hands-on resources to prepare any of the certifications we saw. You will see the labs where you can train without breaking anything (Juice Shop, WebGoat, CTF platforms), the OWASP documentation that works as first-rate study material (WSTG as a testing guide, the Cheat Sheets as a cookbook, ASVS as a checklist), the books and communities that accelerate learning, how to set up a safe and legal practice environment (the point most people neglect) and a week-by-week preparation plan that organizes all of the above. By the end you will have not a list of links, but a method to reach the exam with trained hands.

1. Practical labs: where to train
2. OWASP documentation as study material
3. Books and communities
4. Setting up a safe and legal practice environment
5. Week-by-week preparation plan
6. Common mistakes and tips
7. Exercises
8. Conclusion

Practicing on deliberately vulnerable applications is the right way to train: they are legal, reproducible and designed to teach. These are the reference ones:

Usage recommendation: start with WebGoat (learn why), consolidate with Juice Shop (learn to find it in a real app) and then jump to Web Security Academy and CTF for the offensive focus. For every challenge you solve, mentally map it to its Top Ten 2021 category (M3): that habit is what turns practice into command.

OWASP's documentation is not secondary "reference material": it is first-class study material, free and aligned with the syllabi. Each project has a concrete use:

• WSTG (Web Security Testing Guide) — your testing guide. It is the methodological manual for how to test each type of vulnerability, with identifiers (WSTG-XXXX). Use it as a "what to test and how" checklist when you practice in the labs; it is practically the syllabus of web pentesting certifications.
• OWASP Cheat Sheet Series — your defensive cookbook. Concrete sheets ("how to prevent SQLi", "how to store passwords") that answer "and how do I fix it?". Essential for the secure coding focus.
• ASVS — your verification checklist. Walk its requirements by chapter (V2 authentication, V4 access, V5 validation...) and verify each one against the app you practice on. It is the bridge between attacking and defending.
• Top Ten — your mental map. The taxonomy with which you classify everything you find.

The flow of the diagram is the ideal learning loop: you test with WSTG, you find, you classify with the Top Ten, you remediate with the Cheat Sheet and you verify with ASVS. Walking it over and over on Juice Shop or WebGoat, you internalize both the attack and the defense at once.

Labs teach you to do; books and the community give context and accelerate:

• Reference books: The Web Application Hacker's Handbook (the bible of web pentesting, the basis for PortSwigger), Real-World Bug Hunting by Peter Yaworski (applied bug bounty), and the OWASP documentation itself in PDF.
• Communities: the OWASP Slack, the OWASP local chapters (talks and events, often free), the platform forums (TryHackMe/HTB), and bug bounty communities. Participating accelerates learning and opens professional doors.
• Blogs and writeups: the writeups of CTF challenges and bug bounties teach real methodology. Reading them after attempting a challenge on your own multiplies what you learn.

Tip: do not hoard resources. Choose one lab, one guide (WSTG) and one community, and go deep. Scattering is the number one enemy of preparation.

This is the point most people overlook and the most important from the ethical and legal standpoint, consistent with everything the course has argued: you only attack what you have explicit permission to attack. Scanning or exploiting other people's systems -even "to practice"- is a crime. Practice is done in an isolated, self-owned environment:

• Isolate the network. Run the labs in a virtual machine (VirtualBox/VMware) or in Docker, with the network in host-only or internal mode, without exposing them to the Internet.
• Contain the target. Juice Shop, WebGoat and DVWA run in containers on your own machine; the "target" and the "attacker" live on your computer.
• Use platforms that already grant permission. Hack The Box, TryHackMe and the Web Security Academy explicitly authorize you to attack their environments: it is the ideal legal framework.
• Never use real production systems, yours or anyone else's. Not even BazarNube: to practice, clone it into a lab environment.

Minimal example of starting Juice Shop locally with Docker (isolated, accessible only from your own machine):

Line-by-line explanation: docker run creates the container; --rm deletes it on stop (clean and reproducible); -p 127.0.0.1:3000:3000 publishes the port only on your loopback, so the vulnerable lab is not reachable from the network; the bkimminich/juice-shop image is the project's official one. This discipline of isolation is the practical version of the ethics the course has stressed from the start.

A concrete plan is worth more than a hundred loose resources. This is an adaptable 8-week plan aimed at reaching a hands-on appsec exam. Adjust the pace to your availability and to the certification chosen in 09-02.

Rules of the plan: each session ends with notes (what you found, how, how it is remediated); always map to the Top Ten and to ASVS; and review with a delay what you get wrong, not what you already command. Week 8 (mock exam) is non-negotiable: reaching the exam without having rehearsed under real conditions is the most common mistake.

• Hoarding resources without practicing. Watching ten courses is not the same as solving one challenge. Prioritize the hands-on: an hour in Juice Shop teaches more than three of passive video.
• Practicing on other people's systems "to learn". It is illegal, no exceptions. Always use your own isolated labs or platforms that authorize you. Ethics is not a separate module: it is the condition for everything else.
• Studying only the attack or only the defense. Complete appsec needs both: walk the loop WSTG -> Top Ten -> Cheat Sheet -> ASVS so you do not end up lopsided.
• Not reviewing with a delay. What you solve today and do not repeat gets forgotten. Retention is built by spacing the review, not cramming it.
• Tip: document each challenge as if it were a professional report (finding, evidence, impact, remediation). It is exactly what hands-on exams and real clients ask for, and it forces you to think like a professional, not like a challenge player.

Exercise 1. Set up OWASP Juice Shop locally in an isolated way and solve an introductory-level challenge. Document the finding with this format: vulnerability, Top Ten 2021 category, how you found it and how it would be remediated (using the corresponding Cheat Sheet).

Exercise 2. Design your personal 6-to-8-week preparation plan toward the certification you chose in 09-02. State, week by week, focus, activity and resource, adapting this lesson's template to your profile and availability.

Exercise 3. Explain in 4-5 sentences why it is essential to isolate your practice lab and what legal difference there is between attacking Juice Shop in your Docker and "practicing" against a public website without permission.

Solution 1. Model answer (the "Score Board" challenge / access to an unlisted area): "I found an admin feature accessible by manipulating the URL without authorization. Vulnerability: broken access control (IDOR/exposed function). Top Ten 2021: A01. How: I explored unlinked routes and modified parameters until I reached a resource I should not have seen. Remediation (Authorization Cheat Sheet): apply server-side access control for every object and function, deny by default and verify the requester's identity." Any challenge counts as long as it follows the finding-category-method-remediation format.

Solution 2. There is no single solution. A good plan reuses the lesson's weekly structure but adapted: an aspiring pentester will give more weight to weeks 5-6 (exploitation, CTF) and to Web Security Academy; an aspiring defender (CSSLP) will reinforce weeks 2, 4 and 7 (WebGoat, WSTG, ASVS) and add S-SDLC reading. The right thing is for the plan to be concrete (focus + activity + resource per week), realistic about your time and coherent with the chosen certification.

Solution 3. "Isolating the lab (VM/Docker on an internal network, port on 127.0.0.1) prevents the deliberately vulnerable app from being reachable from the Internet and compromising your machine or network. The legal difference is total: Juice Shop in your Docker is your system, you have full permission to attack it; someone else's public website has not authorized you, and scanning or exploiting it is a crime even if your intention is to learn. The rule is simple and non-negotiable: you only attack what you own or what you have been authorized to in writing."

Here the journey ends. It is worth looking back and seeing the distance covered. You started perhaps not knowing what OWASP was; and you met BazarNube, a marketplace full of holes and with no security culture. With the Top Ten 2021 (M3) you put a name to its vulnerabilities; with ASVS (M4) you turned security into verifiable requirements; with SAMM (M5) you charted the roadmap to mature the program; with ZAP (M6) you automated detection in the pipeline; and with the good practices (M7) -S-SDLC, threat modeling, DevSecOps, culture and champions- you stitched it all into a continuous process. In module 8 you applied it end to end, watching BazarNube transform from reactive and vulnerable to mature and proactive. In this module 9 you measured your command, understood OWASP's real role in the certification ecosystem and take away a concrete plan to accredit it.

If there is one single idea that should stay with you, it is this: security is not a state you reach, but a practice you maintain. It is not a phase, or a tool, or a passed exam: it is a continuous property of the process, the code and the culture, cultivated every day. BazarNube is not "secured forever"; it is in a living program that watches, measures and improves. Nor do you finish your learning here: you finish the course with the foundations laid and your hands trained to keep building. Get certified if it helps you, keep practicing in the labs, take part in the OWASP community and, above all, carry this mindset to every application you work on. The next vulnerable marketplace you come across may not be fictional, and now you know exactly what to do. Congratulations, and welcome to the craft of building secure software.