wstg VS awesome-devsecops

At the beginning, I read all things in here https://owasp.org/www-project-web-security-testing-guide/, also gets familiars with owasp top 10. But later on, I focus on a few techniques only.

I highly recommend PortSwigger's Web Security Academy and have a look at the OWASP Web Security Testing Guide.

You can follow OWASP web testing guide to learn about the test cases performed during testing.

Most web app testing is performed using this guide https://owasp.org/www-project-web-security-testing-guide/

I highly recommend the OWASP Testing Guide: https://owasp.org/www-project-web-security-testing-guide/

Hi, sit and learn https://owasp.org/www-project-web-security-testing-guide/ that's the best way, than may be EJPT.

A short-lived branch-per-issue helps ensure that its resulting pull request doesn’t get too large, making it unwieldy and hard to review carefully. The definition of “short” varies depending on the team or project’s development velocity: for a small team producing a commercial app (like a startup), the time from issue branch creation to PR probably won’t exceed a week. For open source projects like the OWASP WSTG that depends on volunteers working around busy schedules, branches may live for a few weeks to a few months, depending on the contributor. Generally, strive to iterate in as little time as possible.

Check this repo https://github.com/devsecops/awesome-devsecops

DevSecOps

You might be able to find some pre-built apps that fit the bill in the Training section of this Awesome DevSecOps list on GitHub. I've used the OWASP apps for AppSec learning before. They were very helpful to me!