By completing this course, learners will be able to:

• Analyze web application source code to identify security weaknesses.
• Apply manual code review, fuzzing, static analysis, and dynamic analysis techniques.
• Identify and exploit advanced web application vulnerabilities.
• Assess advanced SSRF and persistent XSS vulnerabilities.
• Exploit .NET deserialization vulnerabilities and achieve remote code execution.
• Perform blind SQL injection and advanced data-exfiltration techniques.
• Analyze PHP type juggling, magic hashes, and authentication weaknesses.
• Assess PostgreSQL extensions, user-defined functions, and large objects.
• Bypass file-upload, REGEX, and character-based restrictions.
• Identify server-side template injection and XML External Entity vulnerabilities.
• Analyze weak random token generation and session security weaknesses.
• Assess DOM-based XSS and WebSocket-based command injection.
• Develop repeatable exploitation methodologies for complex web applications.
• Prepare for the practical OffSec Web Expert (OSWE) certification exam.

Module 1: JavaScript Prototype Pollution

• Understand JavaScript inheritance and prototype behavior.
• Identify prototype pollution vulnerabilities.
• Manipulate application logic through polluted objects.
• Understand potential paths to code execution.

Module 2: Advanced Server-Side Request Forgery (SSRF)

• Identify advanced SSRF vulnerabilities.
• Bypass SSRF filters.
• Access internal resources.
• Analyze complex application architectures.
• Exploit SSRF in advanced application scenarios.

Module 3: Web Security Tools and Methodologies

• Web security testing methodologies.
• Fuzzing.
• Static analysis.
• Dynamic analysis.
• Manual code review.
• Building repeatable vulnerability discovery processes.

Module 4: Source Code Analysis

• Analyze application source code.
• Understand application logic and data flows.
• Identify potential attack surfaces.
• Locate security weaknesses that may not be visible through black-box testing.

Module 5: Persistent Cross-Site Scripting

• Identify persistent XSS vulnerabilities.
• Analyze server-side storage of malicious input.
• Understand attacks against multiple application users.
• Exploit persistent XSS in realistic application scenarios.

Module 6: Session Hijacking

• Understand web session management.
• Identify weaknesses in session handling.
• Analyze session tokens and authentication state.
• Exploit session hijacking vulnerabilities.

Module 7: .NET Deserialization

• Understand insecure deserialization.
• Analyze .NET serialization mechanisms.
• Identify vulnerable deserialization paths.
• Exploit deserialization weaknesses.

Module 8: Remote Code Execution

• Analyze vulnerabilities leading to RCE.
• Develop exploitation chains.
• Understand server-side code execution.
• Demonstrate practical impact of RCE vulnerabilities.

Module 9: Blind SQL Injection

• Identify blind SQL injection.
• Work without direct database error feedback.
• Extract information through indirect application responses.
• Apply different blind SQL injection techniques.

Module 10: Data Exfiltration

• Extract sensitive information from vulnerable applications.
• Use SQL injection for data extraction.
• Apply XXE-based data extraction techniques.
• Analyze compromised file-upload functionality for information disclosure.

Module 11: Bypassing File Upload Restrictions and File Extension Filters

• Analyze file-upload security controls.
• Identify extension-based restrictions.
• Bypass upload validation mechanisms.
• Understand how insecure upload handling can lead to compromise.

Module 12: PHP Type Juggling with Loose Comparisons

• Understand PHP type conversion.
• Analyze loose comparison behavior.
• Identify authentication bypass opportunities.
• Exploit type-juggling weaknesses.

Module 13: PostgreSQL Extension and User-Defined Functions

• Understand PostgreSQL extensions.
• Analyze user-defined functions.
• Access data through database functionality.
• Identify opportunities for command execution and persistence.

Module 14: Bypassing REGEX Restrictions

• Understand regex-based input validation.
• Identify weaknesses in restrictive patterns.
• Bypass regex restrictions.
• Inject malicious input where validation is insufficient.

Module 15: Magic Hashes

• Understand PHP hash comparison behavior.
• Identify vulnerable authentication implementations.
• Exploit magic-hash conditions.
• Bypass authentication controls in vulnerable applications.

Module 16: Bypassing Character Restrictions

• Analyze character filtering.
• Identify restrictions applied to user input.
• Develop techniques to bypass character limitations.
• Manipulate application behavior through restricted input.

Module 17: UDF Reverse Shells

• Understand user-defined functions in database environments.
• Use UDF functionality in exploitation scenarios.
• Establish reverse shells in controlled environments.
• Connect database exploitation to operating-system compromise.

Module 18: PostgreSQL Large Objects

• Understand PostgreSQL large objects.
• Analyze how large objects can be abused.
• Store or execute malicious content.
• Apply large-object techniques for data access and exfiltration.

Module 19: DOM-Based Cross-Site Scripting (Black Box)

• Analyze browser-side DOM behavior.
• Identify DOM-based XSS.
• Manipulate client-side application logic.
• Exploit XSS without relying directly on server-side interaction.

Module 20: Server-Side Template Injection

• Identify vulnerable server-side templates.
• Analyze template engines.
• Exploit template injection.
• Use SSTI to disclose information or achieve code execution.

Module 21: Weak Random Token Generation

• Analyze token-generation mechanisms.
• Identify predictable or weak tokens.
• Understand session-security implications.
• Exploit weak randomness in authentication and session mechanisms.

Module 22: XML External Entity Injection

• Analyze XML parser behavior.
• Identify XXE vulnerabilities.
• Access files through vulnerable XML processing.
• Understand command-execution and denial-of-service implications.

Module 23: RCE via Database Functions

• Analyze database functions that expose execution capabilities.
• Identify vulnerable database functionality.
• Develop exploitation paths toward remote code execution.
• Understand the relationship between database functionality and server compromise.

Module 24: OS Command Injection via WebSockets (Black Box)

• Understand WebSocket communication.
• Identify command-injection opportunities.
• Test WebSocket input handling.
• Exploit vulnerable WebSocket implementations in controlled environments.

5 Days

WEB-300 is strongly hands-on and includes practical activities throughout the course. Learners work on advanced web application scenarios involving:

• Source-code analysis and manual code review.
• Web application fuzzing.
• Static and dynamic analysis.
• Advanced SSRF exploitation.
• Persistent and DOM-based XSS.
• Session hijacking.
• .NET deserialization.
• Blind SQL injection.
• Data-exfiltration techniques.
• File-upload restriction bypasses.
• PHP type-juggling and magic-hash attacks.
• PostgreSQL extensions and user-defined functions.
• PostgreSQL large objects.
• REGEX and character-restriction bypasses.
• Server-side template injection.
• Weak token-generation scenarios.
• XXE exploitation.
• Database-function-based RCE.
• WebSocket command-injection scenarios.
• Multi-step vulnerability discovery and exploitation.

Certification: OffSec Web Expert (OSWE)

Practical, hands-on and proctored examination.

Conducted through a private VPN environment containing several vulnerable systems.

47 hours and 45 minutes to complete the practical examination.

An additional 24 hours is provided for documentation submission.

Candidates must compromise the assigned targets and provide the required proof.

Candidates must produce a professional penetration-testing report.

Custom exploit source code must be included in the documentation.

A functional script capable of exploiting multiple vulnerabilities on each exam machine is required.

The current passing requirement is 85 out of 100 points.

• Penetration Testers
• Web Application Penetration Testers
• Application Security Engineers
• Security Consultants
• Offensive Security Professionals
• Red Team Professionals
• Bug Bounty Researchers
• Security Researchers
• Developers moving into advanced application security

• Experience with web application security testing.
• Familiarity with Linux.
• Comfort reading and writing at least one programming language.
• Ability to write simple Python, Perl, PHP, or Bash scripts.
• Experience working with web proxies.
• A strong understanding of common web attack vectors and exploitation techniques.
• Practical offensive-security experience equivalent to the foundations covered in PEN-200 and WEB-200.