HTB CWEE study plan

Map every injection family in Domain 3 (SQLi, NoSQLi, command injection, SSTI, LDAP/XPath) to the input sink that carries it and the detection signal that confirms it.

Build a personal payload and detection cheat sheet for SQLi (union, boolean, time-based, stacked, second-order) and practice it against deliberately vulnerable lab apps you set up locally.

Configure an intercepting proxy, a repeater-style tool, and a local database client so you can move from request to confirmed injection in under five minutes.

Write a short triage note for each of three lab findings that records the payload, the observable difference, and the root cause in the source code.

Exploit server-side template injection in at least two template engines, moving from arithmetic confirmation to file read to command execution.

Chain a blind command injection into an out-of-band callback you control to prove execution without visible output.

Demonstrate NoSQL operator injection against a login flow and an LDAP filter injection against a directory-backed search endpoint.

Automate repetitive injection testing with a small script or tool profile, then verify each automated hit manually before recording it.

Enumerate authentication flows for weaknesses: username enumeration, weak reset logic, MFA bypass, and credential stuffing defenses.

Identify and exploit broken access control, including horizontal and vertical privilege escalation and IDOR on numeric, UUID, and hashed identifiers.

Analyze session handling for predictable tokens, missing rotation on login, weak cookie attributes, and fixation opportunities.

Draw an authorization matrix for a multi-role lab application and mark every endpoint where the server trusts client-supplied role or tenant data.

Distinguish reflected, stored, and DOM-based XSS and demonstrate each in a lab, including a CSP bypass where the policy is misconfigured.

Build a CSRF proof of concept against a state-changing endpoint and explain why SameSite and token defenses do or do not stop it.

Exploit prototype pollution in a client-side library to achieve a measurable effect such as DOM XSS or a logic bypass.

Demonstrate DOM clobbering against a script that reads global variables, and document how the markup influences the sink.

Exploit path traversal and local file inclusion to read sensitive files, then escalate LFI to code execution via log poisoning or a wrapper chain.

Bypass upload filters by content type, magic bytes, extension, and path tricks, and achieve execution of an uploaded file in a lab.

Identify insecure deserialization in at least one language ecosystem and build a gadget chain that yields command execution.

Test SSRF against internal metadata endpoints and internal services, including filter bypasses using redirects, DNS rebinding, and alternate IP encodings.

Attack JWT implementations: algorithm confusion, none algorithm, weak secret cracking, and claim tampering with key ID injection.

Walk an OAuth authorization code flow and exploit at least one flaw such as missing state, redirect URI manipulation, or token leakage.

Enumerate and query a GraphQL endpoint, bypass introspection restrictions, and test for authorization gaps on nested mutations.

Test WebSocket endpoints for missing origin checks and authorization on message handlers, and probe cloud-integrated services for metadata and storage misconfiguration.

Run a structured reconnaissance pass on a full lab network: subdomain and virtual host discovery, content discovery, parameter mining, and technology fingerprinting.

Chain at least three lower-severity findings into a full compromise of a lab host, documenting each pivot decision.

Pivot from a web shell to internal services, harvest credentials from configuration files, and reuse them to move laterally.

Write a timeline of the compromise that connects initial access, privilege escalation, and lateral movement to specific requests.

Rewrite three earlier lab findings into client-ready reports with clear title, impact, reproduction steps, evidence, severity rationale, and remediation.

Practice verbal debriefing by presenting one critical finding in a five-minute recorded summary aimed at a non-technical stakeholder.

Map each finding to a defensive control and write remediation guidance that a developer can implement without further questions.

Run a timed review of your weakest domain using a fresh lab target and close any gaps you find before the exam.