OSCE3 case studies
OSCE3 · Put your knowledge to work in context.
OSCE3 is an advanced, hands-on offensive security certification offered by OffSec. It is aimed at experienced penetration testers, red team operators, and exploit developers who already hold foundational certifications and want to prove depth across multiple offensive disciplines rather than a single specialty. The OSCE3 case studies are 5 cases and about 3,799 words.
1Boolean-oracle SpEL injection behind a substring blacklist
Contoso's internal metric builder is a Spring Boot 3.2 service at metrics.corp.internal. Analysts define calculated fields as SpEL expressions in JSON; the server evaluates them with SpelExpressionParser against a map of numbers and returns only a boolean - the expression result coerced through Boolean.TRUE.equals(...) - plus HTTP 200.
603 words, about 3 min2ESC1 against a hardened certificate mapping baseline
Contoso is a single forest with corp.local and an enterprise CA (CA01, Windows Server 2022, patched to the February 2025 baseline) on the same subnet as two domain controllers. From a workstation foothold you obtained credentials for CORP 1, which is nested into a group holding Enroll rights on a published template named Workstation-Auth.
681 words, about 3 min3Persistence and C2 in a non-persistent VDI pool
Your phishing payload lands a C# implant in memory in a Windows 11 23H2 VDI session. The pool is non-persistent: at 03:00 the session is logged off and the VM is recomposed from a gold image, so anything written outside the user's FSLogix profile container disappears.
860 words, about 4 min4Tcache poisoning to the stack on a forking heap service
noted is an x86-64 Linux service on Ubuntu 22.04 (glibc 2.35), started by systemd with Restart=always. The parent binds the socket and forks a child per connection; it never re-execs and never re-randomizes.
691 words, about 3 min5Keygen judgement on a stripped static Go license checker
A vendor ships licensecheck, a 9.4 MB statically linked Go 1.21 binary (linux/amd64) built with -ldflags="-s -w". It reads /etc/license.dat, validates a 32-byte token against a 12-character tenant ID supplied as argv[1], and prints an activation tag that a remote licensing server hashes and compares against its own computation.
964 words, about 5 min