OSWA study plan

Map a deliberately vulnerable practice application by crawling it with a proxy and building a full endpoint inventory (paths, parameters, methods, auth requirements) in a spreadsheet.

Classify every discovered input as reflected, stored, or server-side by tracing each parameter through proxy history and noting where output appears in responses.

Enumerate hidden content with directory/file brute-forcing and technology fingerprinting, then record server, framework, and language versions found in headers and error pages.

Identify at least three candidate SQL injection points from the inventory and document the injection context (string, numeric, ORDER BY, LIKE) for each.

Confirm injection on each candidate point using boolean-based and error-based payloads, recording the exact request/response evidence for each confirmation.

Extract data with UNION-based techniques by determining column count and finding string-compatible columns, then dump a practice database's table names and one credential table.

Automate the confirmed injection points with sqlmap, comparing its output against your manual extraction to verify accuracy.

Test at least two bypass scenarios such as filtered keywords, alternate whitespace, or WAF-style blocking, and document which encoding or syntax change restored injection.

Craft reflected XSS payloads in at least three different output contexts (HTML body, attribute value, JavaScript string) and explain the escaping needed for each.

Build a stored XSS proof of concept that persists across sessions and demonstrate cookie or DOM access in a controlled lab.

Bypass at least two common defenses such as tag filtering or a naive sanitizer, documenting the payload mutation that succeeded.

Review a sample application's Content-Security-Policy header and assess whether it would block your payloads, then adapt one payload to the policy.

Analyze a lab application's session and state-changing requests to determine which lack anti-CSRF tokens and which validate Origin or Referer.

Build a working CSRF proof of concept hosted on a separate origin that performs a state-changing action against the lab application.

Test SameSite cookie behavior by comparing a cross-site form POST against a cross-site image GET and record which cookies are sent.

Probe CORS configurations with crafted Origin headers, including null origin and attacker subdomains, and classify each response as safe, reflective, or credential-leaking.

Identify at least two server-side request features (URL fetch, image import, webhook) in a lab application and confirm they accept user-controlled destinations.

Exploit SSRF to reach an internal-only service and to read a cloud metadata endpoint in a sandboxed environment, capturing the exact responses.

Test filter bypasses including alternate IP encodings, DNS rebinding-style hostnames, and redirect-based bypasses, recording which succeeded.

Draft a remediation note explaining network-level and application-level controls that would have stopped each successful request.

Locate XML-parsing functionality in a lab application and confirm external entity resolution by retrieving a local file through a crafted document.

Escalate the confirmed XXE to read a file outside the web root and, where the parser allows, perform an out-of-band interaction using an external DTD hosted on a listener you control.

Test a blind XXE scenario and document how error-based or out-of-band channels revealed file contents.

Compare a vulnerable parser configuration against a hardened one with entity expansion disabled, and record the differing responses to the same payload.

Fingerprint at least two template engines in lab applications by injecting arithmetic expressions and observing evaluated results versus literal output.

Confirm SSTI and escalate to remote code execution using engine-appropriate payloads, documenting each step from detection to execution.

Test at least one sandboxed or filtered context and document which payload constructions were blocked and which reached evaluation.

Write a detection-focused summary describing how an application should render user input to avoid template evaluation.

Complete one timed end-to-end assessment on a fresh lab target, moving from reconnaissance through at least four vulnerability classes without notes.

Re-test your three weakest techniques from earlier weeks and record improved results against your prior writeups.

Rewrite your personal methodology checklist so each domain has a first-action trigger, a confirmation step, and an evidence-capture rule.

Review every deliverable from weeks 1-7 and close any gaps where evidence or reproduction steps were missing.