I85PREP
⌘ K
OSWA study materials
OSWA study resources

OSWA case studies

OSWA · Put your knowledge to work in context.

The OffSec Web Assessor (OSWA) is a hands-on certification earned by passing the exam tied to the WEB-200 course, Web Attacks with Kali Linux. According to OffSec's course page, the credential demonstrates your ability to identify and exploit vulnerabilities in web applications, and the associated course is aimed at security professionals who want to strengthen web application security testing skills, plus people with web development knowledge and Linux familiarity. The published topic list centers on XSS, CSRF, SQLi, SSRF, XXE, CORS and SSTI, alongside web application reconnaissance, wordlist sourcing, fuzzing, sqlmap, and Burp Suite tools such as Repeater, Comparer, Intruder and Decoder. OffSec describes WEB-200 as 16 modules with case studies and hands-on activities, followed by 9 Challenge labs for self-testing before you book the exam. The OSWA case studies are 5 cases and about 3,835 words.

1

Wildcard DNS and the 200-for-Everything WAF

You are assessing a SaaS provider under a bug bounty program. In scope: .corp-example.com, excluding status.corp-example.com and any third-party hosted pages.

818 words, about 4 min2

Stored XSS in a Support Portal with a Strict CSP

You are testing a customer support portal at support.corp-example.com. Agents view tickets; customers create tickets and can see their own thread.

765 words, about 4 min3

CSRF Token Present but Not Enforced on a Legacy JSON Endpoint

You are assessing an online bank at bank.example.com. The profile page changes email via POST /api/v2/profile/email with JSON and a valid anti-CSRF token in the body.

728 words, about 4 min4

Boolean Blind SQLi Behind a WAF with a Five-Second Timeout

You are testing an e-commerce search at shop.example.com/search?q=widget . Errors are suppressed.

800 words, about 4 min5

PDF Export SSRF with a Redirect and IMDSv2

You are testing a reporting platform at reports.example.com. The “Export to PDF” feature accepts a URL, fetches it server-side, renders it, and returns a PDF.

724 words, about 4 min