This article provides a path on the security testing journey. It is designed to present concepts fundamental to security testing web applications and guide you on where and how to begin. This is not intended to be all-encompassing, but will provide waypoints to guide your security testing journey.