Advanced Web Attacks and Exploitation (Web-300) – OSWEK Certification
Training including examination and certification
.svg)
Machine Learning Engineer
- Web Security Methodology and White-Box Penetration Testing
- Source Code Analysis and Manual Code Review
- Static and Dynamic Analysis
- Fuzzing and Vulnerability Discovery
- Authentication Bypass and Session Hijacking
- Advanced Server-Side Request Forgery (SSRF)
- Persistent Cross-Site Scripting (XSS)
- Blind SQL Injection and Data Exfiltration
- .NET Deserialization and Remote Code Execution
- JavaScript Prototype Pollution
- Bypassing File Upload and Extension Filters
- Developing Custom Exploits
- Chaining of Complex Web Vulnerabilities and Attack Vectors
- Realistic Attack Scenarios and Challenge Labs
- Documentation and Exploit Reporting
- Preparing for the OSWE Certification Exam
Requirements:
For this advanced course, you should already have solid experience in penetration testing and web application security. Ideally, you should have the following knowledge:
- Strong knowledge of web technologies and common web attack vectors
- Experience with web proxies and web security tools
- Strong knowledge of Linux
- Experience in reading and analyzing source code
- Basic programming and scripting skills
Practical offensive security knowledge at the OSCP certification level and/or in-depth knowledge of web application security, similar to the course below, is advantageous:
However, an OSCP or OSWA certification is not a formal requirement for participation in the WEB-300.
To successfully earn certification, it's important that you thoroughly explore technical challenges and practice independently in the labs.
- You apply systematic methods to analyze complex web applications and their source code
- You identify vulnerabilities through static and dynamic analysis as well as fuzzing
- You analyze complex web vulnerabilities and identify appropriate attack techniques
- You exploit advanced vulnerabilities in web applications
- You develop and customize your own exploits for identified vulnerabilities
- You are bypassing authentication, validation, and other security measures
- You combine multiple vulnerabilities to create complex attack paths
- You document vulnerabilities, exploitation steps, and the results of a web application penetration test
The course combines five days of intensive, instructor-led training with a subsequent individual learning and practice phase. During the training days, the “ trainers ” cover the OSWE curriculum in a structured manner and consistently integrate theory with demonstrations, practical exercises, and realistic attack scenarios.
After the training, you’ll reinforce what you’ve learned on your own with your Learn One subscription. For 365 days, you’ll have access to OffSec learning materials and extensive labs to further develop your practical skills and prepare specifically for the exam.
Upon request, participants have the option to attend a half-day refresher session after the training concludes to reinforce their knowledge in preparation for the exam. The refresher session takes place on a separate date to be scheduled after the training. There is no additional cost for participation.
The Learn One subscription includes:
- 365 days of access to the OffSec digital course and the accompanying labs
- Digital OffSec course materials, which can also be downloaded
- Two attempts at the OffSec certification exam included in the course
- Access to over 200 Proving Grounds Practice Labs for additional hands-on training
- Bonus access to the KLCP (Kali Linux Certified Professional) course, including the exam
- Bonus access to the OSWP course (OffSec Wireless Professional), including the exam
The exam fees are included in the seminar price.
With the WEB-300, you'll prepare for the OffSec Web Expert (OSWE) certification. The exam is entirely hands-on: You'll analyze and compromise vulnerable web applications in a private testing environment and develop your own exploits.
- Exam duration: 47 hours and 45 minutes
- Documentation: an additional 24 hours following that to submit the audit report
- Format: practical, proctored hands-on exam in a private VPN environment
- Maximum score: 100 points
- Passing score: 85 out of 100 points
- Test environment: multiple vulnerable target systems with individual test objectives
Exam Questions:
- Identification and Analysis of Complex Vulnerabilities
- Exploitation of the identified vulnerabilities
- Chaining of Multiple Vulnerabilities
- Development of proprietary, functional exploits or PoC scripts
- Evidence of a successful compromise
Test Report: All attack steps, commands used, results, and self-developed exploits must be documented in such a way that a technically skilled person can reproduce the procedure step by step.
A unique feature of the OSWE exam: You demonstrate your expertise by linking complex vulnerabilities into an attack chain and using them to develop your own exploit that can be executed automatically.
Certification
Upon successful completion of the exam, you will receive the OffSec Web Expert (OSWE) certification, as well as a digital certificate and badge from OffSec. The OSWE certification is valid indefinitely and does not need to be renewed.
The WEB-300 is ideal for you if you already have experience in penetration testing and web application security. You want to further develop your skills in analyzing and exploiting complex web applications at an expert level and demonstrate your expertise with the internationally recognized OSWE certification.
This course is specifically designed for:
Penetration Testers & Ethical Hackers: You want to deepen your web security skills and learn how to identify and exploit complex vulnerabilities through source code analysis, and how to link them into attack chains.
Application Security Engineers: You want to analyze web applications from an attacker’s perspective, identify vulnerabilities in the code, and specifically improve application security.
Security Researchers & Exploit Developers: You want to use advanced vulnerability discovery methods and develop your own exploits for complex web vulnerabilities.
Red Team Operators & Experienced Security Professionals: You want to expand your offensive skillset with advanced web attack techniques and demonstrate your practical expertise with OSWE certification.
.svg)