🕷️WEB-300

The certification associated with this course is the OffSec Web Expert (OSWE).

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

These will be the notes I felt were worth writing down as things I was not completely familiar with and/or were new to me at the time of working through this course.
Some sections may be empty due to nothing being worth noting IMO.

WEB-300 - Modules

Module 1: Introduction

Module 2: Tools & Methodologies

Module 3: ManageEngine Applications Manager AMUserResourcesSyncServlet SSQL Injection RCE

Module 4: DotNetNuke Cookie Deserialization RCE

Module 5: ERPNext Authentication Bypass and Remote Code Execution

Module 6: openCRX Authentication Bypass and Remote Code Execution

Module 7: openITCOCKPIT XSS and OS Command Injection - Blackbox

Module 8: Concord Authentication Bypass to RCE

Module 9: Server-Side Request Forgery

Module 10: Guacamole Lite Prototype Pollution

Module 11: Dolibarr Eval Filter Bypass RCE

Module 12: RudderStack SQLi and Coraza WAF Bypass

Module 13: Conclusion

Module 14: ATutor Authentication Bypass and RCE (archived)

Module 15: ATutor LMS Type Juggling Vulnerability (archived)

Module 16: Atmail Mail Server Appliance: from XSS to RCE (archived)

Module 17: Bassmaster NodeJS Arbitrary JavaScript Injection Vulnerability (archived)

Documentation Templates

Templates provided via the OSWE Exam Guide

Submission Checklist:

Your exam report is in PDF format
You have used the following format for the PDF file name "OSWE-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID
Your PDF has been archived into a .7z file (Please do NOT archive it with a password)
You have used the following format for the .7z file name "OSWE-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID
You have made sure that your archive is not more than 200MB
You have uploaded your .7z file to https://upload.offsec.com

PreviousModule 16: Assembling the Pieces: Web Application Assessment Breakdown NextModule 1: Introduction

Last updated 1 year ago

hashtagTable of Contents

hashtagDocumentation Templates

Table of Contents

Documentation Templates