Web application security definition is based on a problem that it is impossible to control the actions of client side application arhitecture which enables submission of arbitrary data to server side of the application. As a result of this problem there ar hundreds of categorized and systemized types of attacks. To minimize possible attack vectors applications need to have approprietly implemented mechanisms for autentification, session menagement, access control and data validation. The most pervalent web application security vulnerabilites are presented and explained in this thesis. Most pervalent vulnerabilities are defined in the results of the last iteration of TOP 10 project of the NGO organization OWASP (The Open Web Application Security Project). The same vulnerabilities are implemented in the vulnerable web application prototype Trampolin. Techonogies used for prototype development are Django framework, Bootstrap and MySQL database server. Prototype application is designed as a platform for training penetration testing skills for FER students. Last chapter of thesis is an overview of avaliable open source tools for automatized penetration testing. With the use of OWASP ZAP and Vega tools, automatized tests where executed and analized on the Edgar, On-Line Exam Web Application.