OSWE case studies
OSWE · Put your knowledge to work in context.
The Offensive Security Web Expert (OSWE) is a practical certification for security professionals who want to demonstrate that they can find and exploit vulnerabilities by reading web application source code rather than by fuzzing blindly. It is aimed at penetration testers, application security engineers, and developers who already understand how web frameworks work and now need to prove they can trace an input from a controller to a dangerous sink, build a working exploit, and chain several small flaws into meaningful access. The OSWE case studies are 5 cases and about 4,580 words.
1Ledger Lite: Sorting Out a Blind ORDER BY
Ledger Lite is a Flask 2.2 reporting service on MySQL 8.0. The DB account rpt holds SELECT on every table in the schema, including users ( username , password hash , reset token ).
987 words, about 5 min2Tenant Tracker: The Guard That Registers Too Late
Tenant Tracker is Express 4.18 + Mongoose. Middleware registration in app.js : adminRouter , mounted at /admin , declares GET /users , which returns every user document including passwordHash , and POST /users/:id : requireAuth accepts any valid HS256 JWT signed with the app secret and trusts the role claim inside it; the claim is minted at login and never refreshed.
845 words, about 4 min3Nimbus Docs: Case-Sensitive Guards and the Zero-Byte Proc File
Nimbus Docs is an Express 4.18 service in a container running as uid 998 ( nimbus ). /srv/nimbus/uploads is a bind mount of an object bucket.
885 words, about 4 min4Pixelpipe: A Sound Allowlist With a Redirect Shaped Hole
Pixelpipe thumbnails remote images. Node 18 + axios 1.6: Inside the VPC, 10.20.4.12:8080 runs an unauthenticated admin API; GET /config returns {"pg dsn":"postgres://..."} and is reachable only from the app subnet.
877 words, about 4 min5Splitwise-lite: Racing a Gift Code Through Eight Workers
Splitwise-lite hands out referral gifts. Each code is worth 25 credits and is meant to be redeemed once.
986 words, about 5 min