CWICP study plan

Map the HTTP request/response lifecycle end to end: methods, status code families, headers that carry security meaning (Host, Origin, Referer, Content-Type, Content-Length, Transfer-Encoding, Set-Cookie), and where each is trustworthy or attacker-controlled.

Explain how browsers parse and normalize URLs, forms, JSON, multipart bodies, and cookies, and list three places where a parser mismatch between browser and server can create a bypass.

Classify injection families (SQLi, NoSQLi, command injection, template injection, LDAP/XPath, header injection, deserialization) by the sink they reach and the encoding they require.

Set up a local lab (containerized vulnerable app plus an intercepting proxy) and confirm you can capture, replay, and edit requests with correct Content-Length and encoding.

Detect and confirm SQL injection across in-band, blind boolean, and time-based channels, and write the exact payload pairs you would use to prove each without damaging data.

Demonstrate second-order injection and explain why input filtering at the entry point fails when the sink re-uses stored data.

Test for OS command injection and server-side template injection, including how to distinguish a template evaluation from simple string reflection.

Test for XML external entity and unsafe deserialization where the application accepts structured input, and describe the minimum proof that avoids reading real files.

Write remediation guidance for each finding that names the correct fix (parameterized queries, allowlist APIs, safe template contexts, disabling dangerous deserializers) rather than generic escaping advice.

Test login flows for username enumeration through response body, status code, and timing differences, and document which channel leaked.

Evaluate password policy and lockout behavior by testing rate limits, account lockout thresholds, and whether lockout itself enables denial of service.

Analyze session tokens for entropy, predictability, rotation on privilege change, and idle versus absolute timeout enforcement.

Test session fixation, cookie attribute handling (Secure, HttpOnly, SameSite, Domain, Path), and logout invalidation on both server and client.

Assess multi-factor authentication: bypass via response manipulation, missing enforcement on alternate endpoints, and recovery-flow weaknesses.

Enumerate access control models in play (horizontal, vertical, context-dependent) and map every endpoint that takes an object identifier.

Test for insecure direct object reference and broken function-level authorization by replaying requests across two accounts with different roles.

Test forced browsing to unlinked administrative paths and verify whether authorization is enforced server-side rather than by hidden UI.

Identify privilege escalation paths through mass assignment, role parameters in request bodies, and trust in client-supplied headers such as X-Forwarded-For or X-Original-URL.

Build a reconnaissance workflow: passive OSINT, DNS enumeration, certificate transparency review, subdomain discovery, and technology fingerprinting, recording sources for every asset.

Test reflected, stored, and DOM-based cross-site scripting, and explain how each requires a different detection strategy and payload context.

Test cross-site request forgery defenses by checking token binding, SameSite behavior, and whether state-changing GET requests exist.

Assess client-side controls: Content Security Policy effectiveness, postMessage origin checks, client-side storage of secrets, and third-party script trust.

Test clickjacking exposure and confirm whether frame-ancestors or X-Frame-Options is actually enforced.

Evaluate TLS configuration: protocol versions, cipher suites, certificate chain validity, HSTS including preload and includeSubDomains, and mixed-content exposure.

Identify weak cryptographic practice in the application layer: homegrown crypto, ECB mode, static IVs, weak password hashing, and secrets committed to client code.

Review server and infrastructure configuration: default pages, directory listing, verbose errors, unnecessary HTTP methods, backup files, and exposed admin or debug interfaces.

Assess hosting-level risks you can legitimately observe: cloud storage permissions, exposed metadata endpoints, and trust boundaries between reverse proxy and application.

Check security headers as a set and explain what each does and does not protect against.

Characterize how a web application firewall sees traffic: normalization, decoding order, and which layers (network, host, application) inspect what.

Build a library of encoding and obfuscation techniques (case variation, comment insertion, alternate encodings, parameter pollution) and test which ones change detection in your lab.

Explain why WAF bypass is a detection-gap finding rather than a primary vulnerability, and write it up so the underlying flaw stays the headline.

Practice safe evasion testing boundaries: scope limits, rate limits, and when to stop rather than degrade service.

Write a finding in a standard structure: title, affected asset, reproduction steps, evidence, business impact, root cause, remediation, and references, with no vendor-specific tooling jargon.

Rewrite three earlier lab findings to remove vague language and replace it with measurable impact and prioritized remediation.

Perform a timed review pass across the heaviest domains (input validation, authentication, authorization) using your own notes only, and log every gap you find.

Prepare a short verbal summary of a critical finding suitable for a non-technical stakeholder.