WEB-300 Advanced Web Attacks and Exploitation by OffSec covers web application penetration testing methodologies and techniques. Learners gain hands-on experience in ethical hacking, vulnerability discovery, and exploit development. Completion of the course and exam earns the OffSec Web Expert (OSWE) certification. This web application security certification validates expertise in advanced web application security testing, including bypassing defenses and crafting custom exploits to address critical vulnerabilities. Topics covered in WEB-300 include JavaScript Prototype Pollution, where attackers manipulate JavaScript’s prototype inheritance model to inject malicious data and compromise application logic, and Advanced Server-Side Request Forgery (SSRF). Delve into advanced techniques for exploiting SSRF vulnerabilities, including bypassing filters, accessing internal resources, and exploiting complex application architectures. Master a variety of cutting-edge web security tools and methodologies, including fuzzing, static analysis, dynamic analysis, and manual code review. Learn how to analyze source code to identify security vulnerabilities, understand the application’s logic, and uncover potential attack vectors. Discover how attackers store malicious code on a web server to launch persistent XSS attacks, targeting multiple users. Learn how attackers take over user sessions, gaining unauthorized access to sensitive information. Understand the risks associated with deserialization in.NET applications and how attackers exploit these vulnerabilities for remote code execution. Explore techniques used by attackers to execute arbitrary code on a target web server, leading to complete system compromise. Learn to exploit SQL injection vulnerabilities without direct application feedback, using techniques to infer information and compromise databases. Understand how attackers extract sensitive data through SQL injection, XXE attacks, and compromised file uploads. The OSWE exam is a rigorous, proctored 48-hour practical assessment of advanced web application penetration testing skills, requiring the identification, exploitation, and reporting of complex vulnerabilities within a real-world environment, culminating in the development of a custom exploit.
