OSWA study guide
OSWA · Work through your exam, one topic at a time.
The OffSec Web Assessor (OSWA) is a hands-on certification earned by passing the exam tied to the WEB-200 course, Web Attacks with Kali Linux. According to OffSec's course page, the credential demonstrates your ability to identify and exploit vulnerabilities in web applications, and the associated course is aimed at security professionals who want to strengthen web application security testing skills, plus people with web development knowledge and Linux familiarity. The OSWA study guide has 8 sections and about 2,567 words.
01Web Application Reconnaissance and Enumeration
This domain tests whether you can turn a single URL into a working inventory of hosts, paths, parameters, technologies, and roles before you send a single exploit payload. The exam rewards methodical mapping and penalises reporting wildcard noise as findings.
372 words, about 2 min02Cross-Site Scripting (XSS)
XSS tests whether attacker-controlled input reaches an HTML or JavaScript execution sink without context-correct encoding. The exam expects you to identify reflected, stored, and DOM-based variants and to choose a payload that fits the exact injection context.
358 words, about 2 min03Cross-Site Request Forgery (CSRF)
CSRF tests whether a state-changing request can be forged from another origin using the victim's ambient session. The exam focuses on finding actions that lack unpredictable, session-bound anti-CSRF protection and on understanding modern cookie defences.
324 words, about 2 min04SQL Injection (SQLi)
SQL injection tests whether input alters query structure. The exam expects reliable detection, DBMS fingerprinting, and data extraction without destroying application state.
327 words, about 2 min05Server-side Request Forgery (SSRF)
SSRF tests whether a server-side URL fetch can be redirected to internal services, cloud metadata, or non-HTTP schemes. The exam emphasises filter bypass and recognising blind SSRF when no response is returned.
300 words, about 2 min06XML External Entity (XXE) Injection
XXE tests whether an XML parser resolves external entities or DTDs supplied by the attacker. The exam expects you to find XML-accepting surfaces, extract files, and pivot to out-of-band exfiltration when output is suppressed.
321 words, about 2 min07Cross-Origin Resource Sharing (CORS) Misconfiguration
CORS misconfiguration tests whether a server reflects an untrusted Origin and permits credentialed reads. The exam focuses on the exact header combination that lets an attacker origin read authenticated responses.
272 words, about 1 min08Server-Side Template Injection (SSTI)
SSTI tests whether user input is concatenated into a server-side template and evaluated. The exam expects engine identification and a path from evaluation to file read or command execution.
293 words, about 1 min