OffSec WEB-200 (OSWA)

Module 1 Secrets of Success with WEB200

Understand some of the general concepts surrounding application security

Recognize the unique mindset of a successful application security professional

Understand the pillars of prerequisite knowledge for application security

Introduction to Security Concepts

Understand the CIA triad and what it means

Understand other key terms and unique traits of this field

Understand the basic tools available to students

Getting Started With WEB200

Understand the basic tools available to students

Understand how to be hands-on with the material

Understand how to connect to the VPN

Module 2 Tools

Getting Started

Learn how to edit the /etc/hosts file

Understand how to test and confirm that our host file changes are working

Develop a basic understanding of proxies

Burpsuite

Learn how to leverage Burp Suite's built-in browser

Understand how to work fluently with the Proxy tab and Intercept functionality

Understand how to use both Repeater and Intruder

Nmap

Understand how to execute an Nmap NSE Script

Learn how to scan a specific port

Wordlists

Develop an understanding of the wordlist concept

Understand how we attempt to select the best wordlist for our scenario

Learn the basics needed to construct our own wordlist

Gobuster

Learn about Retrieval Practice

Understand Spaced Practice

Wfuzz

Learn how to discover files using Wfuzz

Discover how to find directories with Wfuzz

Understand how to discover parameters with Wfuzz

Learn how to leverage Wfuzz to fuzz parameters

Develop the skills to fuzz POST data using Wfuzz

Hakrawler

Learn what a crawling or spidering tool is

Understand how hakrawler works with https://archive.org (The Wayback Machine) to gather its results

Shells

Learn how to determine the web technology of a web application

Understand how to choose the correct shell (matching the web technology)

Module 3 Cross-Site Scripting Introduction and Discovery

Introduction to the Sandbox

Understand how to use the custom sandbox

JavaScript Basics for Offensive Uses

Understand fundamentals of JavaScript

Read and understand basic JavaScript code

Use JavaScript APIs to exfiltrate data

Cross-Site Scripting - Discovery

Understand the different types of XSS

Exploit reflected server XSS

Exploit stored server XSS

Exploit reflected client XSS

Exploit stored client XSS

Module 4 Cross-Site Scripting Exploitation and Case Study

Cross-Site Scripting - Exploitation

Case Study: Shopizer Reflected XSS

Discover an XSS vulnerability in Shopizer

Create advanced payloads to load external JavaScript resources

Discover application-specific attack vectors

Exploit a Shopizer user using application-specific attacks

Module 5 Cross-Origin Attacks Same-Origin Policy

Penetration Testing Reports

Understand what an origin is

Understand the Same-Origin Policy and how it interacts with cross-origin requests

SameSite Cookies

Understand the concept of cross-origin requests

Understand the SameSite attribute and its three possible settings

Cross-Site Request Forgery CSRF

Construct an Executive Summary

Understand how to identify cross-site request forgery vulnerabilities

Understand how to exploit cross-site request forgery vulnerabilities

Case Study: Apache OFBiz

Discover a CSRF vulnerability in a real-world web application

Exploit a CSRF vulnerability to create a new user

Use JavaScript to chain multiple CSRF requests

Understand how the SameSite attribute influences different versions of CSRF attacks

Cross-Origin Resource Sharing CORS

Understand the concept of CORS

Understand the common headers found on CORS requests

Understand the common headers found on CORS responses

Exploiting Weak CORS Policies

Understand how to identify CORS response headers

Understand how CORS policies that trust arbitrary origins can be exploited

Understand how CORS policies that implement incomplete allowlists can be exploited

Module 5 Introduction to SQL

SQL Overview

Understand the basic syntax of SQL

Understand how to retrieve data from a table

Module 6 SQL Injection

Understand the concept of SQL injection

Understand how to test and exploit SQL injection vulnerabilities

Understand how to use sqlmap for automation

Module 7 Directory Traversal Attacks

Understand traversal strings and pathing

Understand directory listing and exploitation

Understand how to exploit traversal vulnerabilities

Module 8 XML External Entities

Understand XML syntax and entities

Understand XXE vulnerabilities

Learn XXE testing and exploitation techniques

Module 9 Server-side Template Injection

Understand templating engines and security risks

Discover SSTI vulnerabilities

Exploit SSTI to achieve RCE

Module 10 Command Injection

Understand common command injection scenarios

Learn discovery and exploitation techniques

Understand reverse shells and file transfers

Module 11 Server-side Request Forgery

Understand SSRF concepts and attack paths

Learn testing and exploitation methods

Understand SSRF in cloud environments

Module 12 Insecure Direct Object Referencing

Understand IDOR concepts

Learn static and database object IDOR exploitation

Analyze real-world IDOR case studies

Module 13 Assembling the Pieces: Web Application Assessment Breakdown

Perform web application enumeration

Discover authentication bypass techniques

Achieve remote code execution through chained vulnerabilities

Module 14: Authentication Attacks

• Understand common authentication attack vectors
• Identify weak authentication mechanisms
• Understand brute force, password spraying, and credential stuffing
• Test authentication workflows for weaknesses
• Identify account lockout and rate-limiting weaknesses
• Understand multi-factor authentication weaknesses and bypass scenarios
• Assess session management and login protections

Module 15: File Upload Vulnerabilities

• Understand common file upload attack scenarios
• Identify insecure file validation controls
• Test extension, MIME type, and magic byte validation
• Bypass upload restrictions
• Upload malicious files to achieve code execution
• Understand storage-related risks in file upload systems
• Exploit file upload vulnerabilities in real-world scenarios

Module 16: Authentication and Session Security

• Understand session management fundamentals
• Analyze session tokens and cookies
• Identify insecure session handling
• Test logout and session invalidation mechanisms
• Identify session fixation vulnerabilities
• Identify session hijacking opportunities
• Understand secure cookie configurations

Module 17: API Security Testing

• Understand API architecture and common attack surfaces
• Identify authentication and authorization weaknesses in APIs
• Test REST and JSON-based endpoints
• Identify insecure object references in APIs
• Test rate limiting and abuse protections
• Analyze API responses for sensitive information disclosure
• Exploit common API vulnerabilities

Module 18: Business Logic Vulnerabilities

• Understand business logic flaws
• Identify abuse cases in workflows
• Test application logic for unintended behaviors
• Bypass workflow restrictions
• Identify privilege escalation through business logic abuse
• Assess impact of logic-based attacks

Module 19: Race Conditions

• Understand race condition vulnerabilities
• Identify concurrency-related flaws
• Test applications for timing-based issues
• Exploit race conditions in critical workflows
• Understand mitigation strategies for race conditions

Module 20: Access Control Vulnerabilities

• Understand access control concepts
• Test vertical privilege escalation
• Test horizontal privilege escalation
• Identify missing authorization checks
• Exploit broken access control vulnerabilities
• Assess access restrictions across application roles

Module 21: Deserialization Vulnerabilities

• Understand serialization and deserialization concepts
• Identify insecure deserialization vulnerabilities
• Test applications for unsafe object processing
• Exploit insecure deserialization to achieve code execution
• Understand common deserialization attack chains

Module 22: WebSocket Security

• Understand WebSocket architecture
• Identify common WebSocket attack vectors
• Analyze WebSocket traffic using Burp Suite
• Test authentication and authorization in WebSockets
• Exploit insecure WebSocket implementations

Module 23: GraphQL Security

• Understand GraphQL fundamentals
• Identify GraphQL attack surfaces
• Perform schema enumeration
• Test authorization and data exposure issues
• Exploit insecure GraphQL endpoints
• Assess query complexity and abuse risks

Module 24: Reporting

• Document vulnerabilities clearly
• Write technical findings with evidence
• Develop remediation recommendations
• Construct executive summaries
• Present risk and impact effectively

Module 25: Full Web Application Assessment

• Perform complete web application assessments
• Apply enumeration techniques
• Discover vulnerabilities across attack surfaces
• Chain vulnerabilities to maximize impact
• Document findings professionally
• Deliver a complete penetration testing report

Module 25 (if your WEB-200 syllabus includes advanced modules / capstone content):

Module 26: Advanced Exploitation Techniques

• Chain multiple vulnerabilities for deeper exploitation
• Understand post-exploitation in web environments
• Escalate impact from low severity findings
• Leverage misconfigurations for privilege escalation
• Perform advanced attack path analysis

Module 27: Advanced Payload Development

• Develop custom payloads for web attacks
• Create obfuscated payloads to bypass filters
• Understand payload encoding techniques
• Modify exploit payloads for specific environments
• Improve reliability of exploit delivery

Module 28: WAF Evasion Techniques

• Understand how Web Application Firewalls operate
• Identify WAF detection patterns
• Bypass WAF protections using payload obfuscation
• Test filtering weaknesses in protected applications
• Assess effectiveness of WAF security controls

Module 29: Cloud Web Application Security

• Understand cloud-hosted application attack surfaces
• Identify security risks in cloud deployments
• Test storage exposure and misconfigurations
• Assess cloud identity and access weaknesses
• Evaluate risks in modern cloud-native applications

Module 30: Capstone Assessment

• Perform a full end-to-end web application penetration test
• Enumerate targets and discover attack surfaces
• Identify and exploit vulnerabilities
• Demonstrate attack chaining and impact analysis
• Prepare professional reporting and remediation guidance