HTB CWPE study plan

Map the full injection surface of a deliberately vulnerable practice app by cataloguing every parameter, header, cookie, and JSON field that reaches a database, shell, or template engine

Build a reusable Burp Suite and ffuf workflow that fingerprints server-side languages, frameworks, and templating engines from response headers, error pages, and default file paths

Reproduce union-based and error-based SQL injection against a local lab database, then write a manual UNION payload that extracts table names without relying on sqlmap

Set up a personal notes template that records, for each finding, the exact request, the payload, the observable difference, and the mitigation that would have blocked it

Craft blind boolean-based and time-based SQLi payloads by hand and confirm them with response-length and response-time baselines you compute yourself

Execute NoSQL injection against a MongoDB-backed login and a search endpoint, covering both operator injection in JSON bodies and query-parameter array syntax

Achieve OS command injection through a vulnerable file-processing feature and demonstrate both blind output exfiltration over an outbound channel and in-band output

Identify and exploit a server-side template injection by probing arithmetic expressions in every user-reflected field, then escalate from expression evaluation to file read

Enumerate and attack authentication flows: username enumeration through timing and message differences, credential stuffing protections, password reset token weaknesses, and MFA bypass via response manipulation

Analyze session tokens from three different lab applications for entropy, predictability, and missing rotation on privilege change, and document each weakness with evidence

Exploit a JWT implementation by testing algorithm confusion and weak HMAC secret cracking, then forge a token that reaches an administrative function

Build and execute a stored XSS payload that steals a session cookie protected only by HttpOnly-off configuration, and a separate payload that performs an authenticated action on behalf of the victim

Test three lab applications for CSRF by identifying state-changing endpoints lacking anti-CSRF tokens or SameSite protections, then build a working proof-of-concept HTML page for the strongest finding

Probe CORS configurations with crafted Origin headers, including null origin and subdomain-prefix tricks, and classify each endpoint as safe, reflective, or fully exploitable

Enumerate access control by replaying requests across two accounts at different privilege levels and by forcing numeric and UUID identifiers in every object reference

Identify at least one business logic flaw, such as price manipulation, quantity tampering, or workflow step skipping, and document the abuse case end to end

Map every parameter that accepts a URL or hostname and test each for SSRF, including internal metadata endpoints, localhost services, and redirect-based filter bypasses

Distinguish reflected, stored, and wrapper-based file inclusion by testing path traversal, PHP filter wrappers, and log poisoning for code execution

Identify a deserialization sink in a practice application and demonstrate exploitation, or, if no sink is available, write a working serialized payload for the target language and explain the gadget chain

Compare SSTI and expression-language injection in a Java or .NET context with the SSTI work from week 2 and record how detection differs

Enumerate a REST API from its documentation and from traffic alone, then test for mass assignment, excessive data exposure, and broken object property level authorization

Test GraphQL endpoints for introspection exposure, query depth abuse, and field-level authorization gaps

Probe for prototype pollution in a JavaScript-heavy application and demonstrate a client-side gadget or a server-side denial-of-service effect

Automate a full reconnaissance pass with content discovery, parameter mining from JavaScript files, and technology fingerprinting, and record how long each stage takes

Chain at least three findings from earlier weeks into one exploit path, for example SSRF to internal service to credential theft to authenticated injection

Escalate from a low-privilege web shell or command injection foothold to reading application configuration and database credentials

Practice writing a concise finding narrative that states the chain, the impact, and the remediation for each link without padding

Re-run two previously solved labs cold, without notes, and record every step where you needed to look something up

Complete two full timed practice assessments covering all nine domains and log the time spent per domain against the exam weighting

Review every missed question and convert each into a one-line rule you can recall under pressure

Re-test the three domains where your timed accuracy was lowest by solving two fresh labs in each

Finalize a one-page pre-exam reference sheet limited to payload syntax, detection signals, and remediation mappings