Advanced Web Attacks & Exploitation

All efforts for the AWAE course and preparation for the Offensive Security Web Expert (OSWE) exam.

Study Strategy

Several rounds of course content
First round:
- Watch videos
- Read text and take good notes
- Complete the main exercises
Second round:
- Watch videos again
- Read text and take more notes as-needed
- Craft your own tools and scripts in a language other than python
- Complete exercises AND all extra mile exercises
Further study:
- Find interesting vulns in open source software, find the vuln from scratch and analyze
  - Analyze APKs for Android apps. Take 8 hours and analyze several each, tryna find vulns as if you're mid-test and have a time limit to find exploit chains
  - Find interesting vulns in OSS.
    - Use vuln apps first to help develop custom regex tools for SAST: Webgoat (Java), JuiceShop (JavaScript), Mutillidae (PHP), .NETGoat (C#)
    - Check out an app in each relevant language that may not have had any security review done. Try to find some vulns and get some CVEs!!
      - Check for the main suspects as taught in the course for each app, timebox it, and move on to another one.
    - Make sure to pay attn to app architecture, request routing, etc in each language:
      - Java
      - JavaScript (node.js)
      - PHP
      - C#/.NET
- HackTheBox and CTFs (see wetw0rk's prep guide)
  - SecureCodeWarrior (see bookmark in AWAE)
- Codecademy courses
  - Java
  - JavaScript
  - PHP
  - C#

Taken from publicly-available syllabus.