🦉WEB-200

The certification associated with this course is the OffSec Web Assessor (OSWA).

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

These will be the notes I felt were worth writing down as things I was not completely familiar with and/or were new to me at the time of working through this course.

Some sections may be empty due to nothing being worth noting IMO.

Table of Contents

WEB-200 - Modules
Module 1: Introduction to WEB-200
Module 2: Tools (archived)
Module 3: Web Application Enumeration Methodology
Module 4: Introduction to Burp Suite
Module 5: Cross-Site Scripting Introduction and Discovery
Module 6: Cross-Site Scripting Exploitation and Case Study
Module 7: Cross-Origin Attacks
Module 8: Introduction to SQL
Module 9: SQL Injection
Module 10: Directory Traversal Attacks
Module 11: XML External Entities
Module 12: Server-side Template Injection - Discovery and Exploitation
Module 13: Command Injection
Module 14: Server-side Request Forgery
Module 15: Insecure Direct Object Referencing
Module 16: Assembling the Pieces: Web Application Assessment Breakdown

Documentation Templates

Templates provided via the OSWA Exam Guide

Submission Checklist:

• Your exam report is in PDF format

• You have used the following format for the PDF file name "OSWA-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID

• Your PDF has been archived into a .7z file (Please do NOT archive it with a password)

• You have used the following format for the .7z file name "OSWA-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID

• You have made sure that your archive is not more than 200MB

• You have uploaded your .7z file to https://upload.offsec.com

21KB

OSWA-Exam-Report.docx

Open

Microsoft Word format

40KB

OSWA-Exam-Report.odt

Open

OpenOffice/LibreOffice format