OSWE study plan

Trace user-controlled input from an HTTP handler to a database query in a supplied codebase and annotate every unsafe sink

Write a boolean-based blind SQL injection extractor that recovers a value character by character without a GUI tool

Convert a manual UNION-based injection into a parameterized Python script that auto-detects column count and data types

Exploit NoSQL operator injection in a JSON login handler and LDAP filter injection against a directory-backed search endpoint

Exploit OS command injection through a shell-invoking function and convert it into an out-of-band channel for command output

Run an automated static analysis pass (semgrep or CodeQL rules) over a vulnerable application and triage results down to confirmed true positives

Inventory dangerous sinks (eval, exec, system, popen, unserialize, template render) and rank them by reachability from an unauthenticated route

Document a source-to-sink dataflow diagram for the two highest-risk taint paths found

Diagram the full authentication flow of a test application and list each point where a session token is created, rotated, or trusted

Exploit missing function-level access control and IDOR by scripting identifier enumeration across at least ten endpoints

Demonstrate a JWT weakness: algorithm confusion or offline cracking of a weak signing secret, then forge a privileged token

Probe password-reset and remember-me logic for predictable or replayable tokens and record the outcome

Build a repeatable reconnaissance checklist covering technology fingerprinting, endpoint discovery, and extraction of hidden routes and keys from bundled JavaScript

Trace a stored cross-site scripting flaw from input to an unescaped output sink in source code, then chain it to a state-changing privileged action

Bypass a restrictive Content-Security-Policy and a common input filter using encoding variations and DOM sink analysis

Exploit path traversal to read files outside the intended directory, including at least three filter-bypass techniques (encoding, double dots, truncation)

Achieve code execution through an unrestricted file upload by defeating extension, MIME-type, and content-type validation separately

Escalate local file inclusion to remote code execution via log poisoning and via a PHP stream wrapper, and test remote file inclusion where allow_url_include is enabled

Locate insecure deserialization sinks in at least two language ecosystems and build a working gadget-based payload for one

Craft a serialized-object exploit that abuses magic methods to reach a dangerous call, and explain why the chain survives validation

Confirm server-side template injection by fuzzing arithmetic template expressions, then escalate to command execution with an engine-specific payload

Write detection heuristics that distinguish a genuine deserialization or SSTI finding from a false positive

Exploit server-side request forgery to reach an internal-only service, defeating an allowlist using redirects, DNS rebinding, or alternate IP encodings

Exploit XML external entity processing for local file disclosure and for out-of-band exfiltration through an attacker-controlled DTD

Identify and exploit at least two business logic flaws such as price or quantity manipulation, workflow step skipping, and a race condition on a limited resource

Write a reusable Python exploitation framework with argument parsing, session handling, payload encoding, and structured logging

Chain at least three flaws drawn from different domains into a single exploit path from unauthenticated access to objective completion

Complete one timed full-scope practice engagement and record every point where time was lost or a technique had to be looked up