Custom Exploit Scripting and Vulnerability Chaining
Automate, then chain
OSWE expects working exploit code, usually Python with requests. Structure scripts so each primitive is a function: login and session retention, token or CSRF extraction, a request builder with consistent encoding, and a payload injector. Use a Session object to keep cookies, set explicit timeouts, and print enough state to debug without leaking the whole response.
For blind extraction, implement binary search: for boolean-based SQLi define a predicate function returning true/false from a response marker, then bisect each character over a known charset. For time-based, measure a baseline, choose a delay well above jitter, and confirm with a false predicate before trusting a positive. For command injection and blind SSRF, use out-of-band callbacks rather than guessing. Always URL-encode payloads once, deliberately, and avoid double encoding by mistake.
Chaining is the real skill. A low-severity information leak (version, path, internal hostname) feeds an injection; an IDOR yields an admin token; an upload yields a webshell; a deserialization gadget yields RCE. Write the chain end to end as one script with clear stages, so each stage asserts its precondition before proceeding, and so a re-run is safe.
Traps: forgetting to re-fetch CSRF tokens after each state change, assuming request ordering from a browser carries over to requests, ignoring rate limits and locking accounts, and using verify=False without noting it.
Rule of thumb: build the smallest reliable primitive first, prove it with one request, then wrap it in a loop - never debug a payload and a parser at the same time.