CWLS cheat sheet

CWLS certification targets professionals working with web application security assessment and secure lifecycle practices; the exam is delivered in English and emphasizes applied judgment over trivia.

Scope of practice: identifying, validating, and prioritizing web-layer weaknesses (injection, broken access control, authentication/session flaws, misconfiguration, insecure deserialization, SSRF) rather than network or host exploitation.

Risk rating combines likelihood and impact; CVSS base score covers exploitability and impact metrics but excludes environmental context, so business criticality must be layered on top.

CVSS v3.1 base score ranges: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0; the vector string records each metric so scores are reproducible.

Defense in depth: input validation, parameterized queries, output encoding, least-privilege service accounts, and centralized logging are complementary controls, not substitutes for one another.

Testing authorization requires at least two accounts at different privilege levels; a single-account test cannot distinguish missing access control from correct behavior.

Evidence standards: reproducible request/response pairs, exact payloads, timestamps, and affected endpoint versions; screenshots alone are weak evidence for a report.

Severity inflation erodes program credibility; a finding should state preconditions and realistic attacker capability, not the theoretical worst case.

OWASP Top 10 categories (2021) include Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and SSRF.

Broken access control is tested by manipulating object identifiers, HTTP methods, and path segments; IDOR is the common instance where an object reference lacks an ownership check.

Injection defenses: parameterized statements for SQL, context-aware output encoding for XSS, allow-list validation for command arguments; escaping alone is insufficient for SQL.

Session management: cookies should carry Secure, HttpOnly, and SameSite attributes; session identifiers must be regenerated on privilege change and invalidated server-side at logout.

CSRF is mitigated by synchronizer tokens or SameSite cookies; token validation must occur server-side and tokens must not be exposed in URLs.

File upload controls: validate content type by inspection, store outside the web root, rename files, disable execution in the upload directory, and enforce size limits.

Security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and Referrer-Policy reduce exploitability but are not primary fixes for injection flaws.

Reconnaissance order: scope confirmation, technology fingerprinting, content discovery, authentication mapping, then targeted vulnerability validation within the authorized window.

Scope discipline: only in-scope hosts, ports, and accounts may be tested; out-of-scope discoveries are reported without exploitation, and testing pauses if production availability is at risk.

Non-destructive verification: use proof-of-concept payloads that demonstrate the flaw without data modification, denial of service, or lateral movement unless explicitly authorized.

Rate limiting and throttling reduce the chance of service disruption during automated scanning; detection of a WAF response should prompt manual confirmation rather than evasion escalation.

Authentication testing includes username enumeration, credential policy, lockout behavior, MFA bypass paths, and password reset token predictability.

Business logic flaws (price manipulation, workflow skipping, quantity tampering) require manual reasoning; scanners rarely detect them because the requests are syntactically valid.

Retest criteria: a finding is closed only when the same payload or technique fails and the fix is verified at the layer where the defect existed.

Report structure: executive summary, methodology and scope, findings ranked by risk, technical detail with reproduction steps, remediation guidance, and retest status.

A finding includes title, affected asset, severity with justification, description, evidence, business impact, and a specific remediation the development team can act on.

Remediation guidance should name the control (for example, server-side authorization check on object access) rather than restating the symptom.

False positive handling: reproduce twice, isolate variables, and document the exact conditions; if reproduction fails, downgrade or withdraw the finding.

Communication: critical findings are escalated to the client contact immediately rather than waiting for the final report, per the engagement's escalation clause.

Data handling: test data, credentials, and captured personal information are stored encrypted, retained only as long as the contract allows, and destroyed after delivery.

Metrics that matter to clients include time-to-remediation, recurrence rate of the same weakness class, and coverage of the agreed attack surface.

TLS: TLS 1.2 and 1.3 are acceptable; SSLv3, TLS 1.0, and TLS 1.1 are deprecated; cipher suites should prefer AEAD (GCM, ChaCha20-Poly1305) and forward secrecy via ECDHE.

HSTS with a long max-age and includeSubDomains prevents protocol downgrade; preload requires submission and is hard to reverse.

Certificate validation failures often stem from incomplete chains; the server must send intermediate certificates, not just the leaf.

Sensitive data at rest should use AES-256-GCM or equivalent AEAD; passwords are stored with adaptive hashing (Argon2id, bcrypt, scrypt) plus a per-user salt, never with plain SHA-256.

Cookie scope: Domain and Path attributes widen exposure; set the narrowest path and avoid the parent-domain cookie for session identifiers.

CORS misconfiguration is exploitable when Access-Control-Allow-Origin reflects arbitrary origins together with Access-Control-Allow-Credentials: true.

Clickjacking defense uses frame-ancestors in CSP or X-Frame-Options; the CSP directive supersedes the legacy header in modern browsers.