Web Security Vulnerability Classes and Exploitation
Web Security Vulnerability Classes and Exploitation
The BSCP exam tests whether you can find and exploit real bugs in two target applications under a four-hour limit. Detection is not enough: you must reach a concrete goal such as privilege escalation, data exfiltration, or code execution. The exam emphasizes access control, injection, client-side trust, and server-side request flaws, often chained.
Core rules and concepts
- Enumerate roles, endpoints, parameters, cookies, headers, and state transitions before exploiting.
- Know the minimum proof per class: SQL injection needs boolean, time, UNION, or OOB evidence; XSS needs execution in the victim context; SSRF needs a reachable internal service or Collaborator hit; XXE needs file read or SSRF; command injection needs output or OOB.
- Chain low-impact findings: information disclosure can feed credential attacks, CSRF can bypass token checks, and prototype pollution can reach DOM XSS.
- Use Burp Collaborator for blind bugs: SSRF, XXE, blind XSS, SQLi OOB, and command injection.
Worked example
A search endpoint reflects q inside a JavaScript string: <script>var q='INPUT';</script>. Sending <script>alert(1)</script> is HTML-encoded and fails. The correct reasoning is to identify the context: the input sits in a single-quoted JS string, so break out with ';alert(document.domain);//. If a WAF blocks quotes, try \u0027 or an alternative sink such as </script><img src=x onerror=alert(1)> only if the context allows HTML breakout. The proof is execution, not reflection.
Traps that cost marks
- Reporting reflected input as XSS without proving the execution context.
- Ignoring multiple decoding layers (URL, HTML, JS, Base64).
- Treating a 403 as final; try method changes, path normalization, header overrides, and role parameter pollution.
- Relying on scanner output instead of manually reproducing and chaining the bug.