OSWE study guide
OSWE · Work through your exam, one topic at a time.
The Offensive Security Web Expert (OSWE) is a practical certification for security professionals who want to demonstrate that they can find and exploit vulnerabilities by reading web application source code rather than by fuzzing blindly. It is aimed at penetration testers, application security engineers, and developers who already understand how web frameworks work and now need to prove they can trace an input from a controller to a dangerous sink, build a working exploit, and chain several small flaws into meaningful access. The OSWE study guide has 9 sections and about 2,870 words.
01Source Code Analysis and Web Application Reconnaissance
Begin with the attack surface: enumerate routes from framework route files, .htaccess rewrites, servlet mappings, or the main dispatcher, then list every source - GET , POST , COOKIE , SERVER , JSON bodies, headers, uploaded files, and even database rows that are later rendered. Next locate sinks : system , exec , popen , eval , include , unserialize , string-concatenated SQL, template rendering, file get contents , and header setters.
343 words, about 2 min02Authentication, Session Management, and Access Control Flaws
Authentication asks who you are; authorization asks what you may do. Most misses are on the second question.
327 words, about 2 min03Injection Vulnerabilities (SQL, NoSQL, LDAP, OS Command)
Injection exists wherever data crosses into a parser. Learn the grammar of each one.
305 words, about 2 min04Cross-Site Scripting and Client-Side Attack Chaining
XSS is a context problem. Identify the exact output location - HTML body, attribute, quoted attribute, JavaScript string, JSON, CSS, URL - then pick a payload for that context.
323 words, about 2 min05File Handling Flaws (Upload, Path Traversal, Local/Remote File Inclusion)
Upload flaws usually come down to how the filename and content are validated. Test extension blacklists with alternate executable extensions ( .phtml , .php5 , .phar ), case variation, trailing dot or space, and double extensions.
313 words, about 2 min06Deserialization and Server-Side Template Injection
Deserialization is dangerous because the format lets a caller define object type and properties. In PHP, unserialize on user data triggers magic methods ( wakeup , destruct , toString ), and a POP chain strings harmless gadgets together until a dangerous sink fires.
314 words, about 2 min07SSRF and XML External Entity Processing
SSRF appears wherever the server retrieves a URL you influence: image fetchers, webhooks, PDF renderers, URL previews, importers, and proxy endpoints. First establish whether responses come back (full SSRF) or only timing and errors (blind).
322 words, about 2 min08Business Logic and Authorization Bypass
Logic flaws need no malformed input; they need a sequence of legitimate requests in an illegitimate order. Start by writing the intended workflow as state steps, then look for steps that can be skipped, repeated, or reordered.
316 words, about 2 min09Custom Exploit Scripting and Vulnerability Chaining
OSWE expects working exploit code, usually Python with requests . Structure scripts so each primitive is a function: login and session retention, token or CSRF extraction, a request builder with consistent encoding, and a payload injector.
307 words, about 2 min