HTB CWES study plan

Map every SQL injection variant (in-band UNION, error-based, boolean/time-based blind, second-order) to the exact HTTP parameter and DBMS error signature that reveals it

Practice manual UNION column-count discovery and data extraction against a local MySQL and PostgreSQL instance without relying on sqlmap output

Build a decision tree for choosing between sqlmap tamper scripts and hand-written payloads when a WAF filters quotes, spaces, or keywords

Demonstrate command injection via separators, substitution, and blind out-of-band channels (DNS or HTTP callback) on a deliberately vulnerable app

Write a one-page comparison of SSTI payload escalation across Jinja2, Twig, and Freemarker engines, noting sandbox escape primitives

Enumerate LDAP and XPath injection points by identifying filter syntax in login forms and search endpoints, then craft authentication-bypass payloads for each

Automate content discovery with ffuf and feroxbuster using tailored wordlists, and record how response size and status codes distinguish real endpoints from soft-404s

Extract and analyze JavaScript bundles and source maps to uncover hidden API routes, parameters, and client-side validation logic

Fingerprint a target stack from headers, cookies, error pages, and default files, and document the evidence trail for each technology identified

Chain a recon finding into a confirmed injection vulnerability end-to-end on a lab target

Classify XSS sinks by context (HTML body, attribute, JavaScript string, URL, CSS) and write context-appropriate payloads for each

Bypass common filters and CSP policies using encoding tricks, DOM-based sinks, and trusted-script gadgets, documenting why each bypass works

Build a CSRF proof-of-concept against a state-changing endpoint and explain the token, SameSite, and Origin-header defenses that would stop it

Exploit DOM clobbering and client-side prototype pollution in a lab app to achieve script execution or logic bypass

Convert a stored XSS into session theft or an admin-action forgery in a lab, then write the mitigation for each step

Forge, crack, and abuse JWTs: test alg=none, key confusion, weak HMAC secrets, and kid/jku injection against a lab API

Trace an OAuth 2.0 authorization-code flow and demonstrate redirect_uri manipulation, missing state, and token leakage in referrer or logs

Enumerate IDOR and horizontal/vertical privilege escalation by scripting authenticated requests with two privilege levels and diffing responses

Test session lifecycle flaws: fixation, predictable tokens, missing rotation on login, and logout invalidation gaps

Document an access-control matrix mapping each role to every endpoint and flag every mismatch

Exploit local and remote file inclusion across PHP wrappers (php://filter, data://, expect://) and log-poisoning to reach code execution

Bypass upload restrictions using content-type, magic-byte, extension double, and .htaccess tricks, then verify execution

Traverse paths with encoding variants (dot-dot-slash, URL encoding, null bytes) to read files outside the web root

Escalate a file-read primitive into credential discovery and then into a shell on a lab host

Write a wrapper-and-filter reference table for PHP, Java, and Node targets

Exploit SSRF against cloud metadata endpoints, internal services, and localhost-only admin panels, including filter bypass via redirects and DNS rebinding

Distinguish blind SSRF from full-read SSRF and set up an out-of-band listener to confirm both

Identify deserialization sinks in Java, PHP, and Python apps and build a gadget chain using a public tool such as ysoserial or PHPGGC in a lab

Analyze a serialized payload byte-by-byte to explain how the gadget chain reaches command execution

Write the detection and remediation guidance for both SSRF and unsafe deserialization

Enumerate and exploit a WordPress installation: version fingerprinting, plugin/theme enumeration with wpscan, and an authenticated admin-to-RCE path

Identify and exploit a known framework-specific vulnerability (for example a Spring, Laravel, or Apache Struts issue) in a lab environment

Deploy a minimal web shell, then upgrade to an interactive reverse shell and establish persistence through a low-privilege service account

Pivot from a compromised web host to an internal service using proxychains or SSH tunneling and document the network path

Practice operational hygiene: clean up artifacts, avoid noisy commands, and log every action for the report

Write a full penetration test report for one prior lab target with executive summary, methodology, findings rated by CVSS, and reproduction steps

Rewrite three findings as developer-ready remediation guidance with concrete code or configuration fixes

Timebox a 90-minute mock assessment on an unseen lab target and produce a findings list under exam-like pressure

Review the whole plan's cheat sheets and access-control matrix, and close gaps flagged by self-assessment

Draft a personal exam-day playbook covering enumeration order, note-taking, and time allocation