Web application security is a critical concern in today's digital landscape, as organizations increasingly rely on web-based technologies to deliver services and manage sensitive data. However, the inherent complexities of web applications expose them to various security vulnerabilities, making them attractive targets for cyber attackers. This thesis aims to contribute to the field of web application security by exploring the practice of penetration testing, following the guidelines established by the Open Web Application Security Project (OWASP) and applying the learned methodology to an adapted environment comprising three compromised virtual machines. By combining industry-standard methodologies and a realistic testing environment, this research seeks to provide valuable insights and practical recommendations for enhancing the security posture of web applications.