Penetration testing targeting web applications, with a focus on OWASP Top 10 vulnerabilities such as SQL injection, XSS, CSRF, broken authentication, insecure deserialization, and misconfigurations. Covers application logic testing, session management, authorization, REST/GraphQL APIs, modern frameworks, and client-side components. Structured methodology to identify exploitable flaws in production or staging web environments.