The OSWE Review and Exam Preparation Guide

What is the OSWE Certification?

Long gone are the days of multiple-choice question exams and memorizing lesson material just long enough to gain a certification—that’s been the case in the penetration testing community, at least.

Such a shift is particularly evident in the well-renowned trainings offered by Offensive Security, and their latest course is no exception. When I came across the Offensive Security Web Expert (OSWE) certification, I was immediately drawn to the promise of becoming a true web app exploit guru, and, spoiler alert—the certification delivered.

Before sitting for the exam to become certified as an OSWE, students must complete the Advanced Web Attacks and Exploitation (AWAE) course and lab environment, which is geared towards seasoned penetration testers looking to take their web application pen testing skills to the next level.

This certification takes a white box approach—that is, discovering vulnerabilities from source code—and is equally valuable to professionals responsible for the overall security of a SaaS solution.

What do you learn?

• Knowledge of how to chain multiple vulnerabilities to achieve a greater impact;
• Great insight into the development process; and
• A thorough understanding of how to spot common mistakes made by programmers—this all while also taking a deep dive into source code review and mapping out how to write advanced web app exploits.

Moreover, if you’ve never performed manual SQL injection before—shout out to SQLMap—you will have it down by the end of this course.

Having recently completed the lab and successfully passed the exam, I can personally attest to the many ways this course has positively impacted my day-to-day work as a penetration tester. I can also speak to the fact that this is not an entry-level endeavor, and the following guide is intended to help aspiring OSWE candidates prepare for the course and make the most of their time in the lab.

What to Expect from the Advanced Web Attacks and Exploitation Course

First, the basics:

• The course is purchased with a package of 30, 60, or 90 days in the lab, and covered in the cost are the fees for your first exam attempt.
• The material provided is comprised of a 270-page PDF course guide, 6-hour video series, and a virtual lab environment, which work together to produce a step-by-step guide on how to exploit the vulnerable web applications hosted in the lab.

And although the training is without a doubt top-notch, I found that additional independent research was required to fully digest many of these advanced topics. Furthermore, you can expect to spend 80-150 hours of studying before moving on to the rigorous 48-hour exam, depending on previous individual experience with both web app exploitation and source code review.

To get a better, more specific idea of what is covered in the course, take a peek at the AWAE Syllabus.

How to Prepare for the AWAE Course

While the AWAE itself absolutely delivers an immersive learning experience chock-full of real-world vulnerabilities, including everything needed to pass the exam, you will have a greater chance of passing on your first attempt if you take the time to prepare for the course itself.

This is especially true for those who have not spent significant time in both the programming and penetration testing worlds.

In order to go in as primed as possible prior to beginning the course, the curated links below provide valuable insight into the necessary tools, languages, and vulnerabilities.

Tools

Burp Suite – Before the course, understand how to set up a temporary project and capture web traffic in Burp Suite Community Edition. Research how to set the scope, intercept requests and manipulate requests using repeater and intruder.

• Bugcrowd University - Introduction to Burp Suite

Sublime Text – As stated in the OSWE Exam Guide, the course includes developing custom applications to automatically exploit the vulnerabilities discovered.  Though various Python scripts serve as starting points for each exploit throughout the course, each student is ultimately responsible for writing unique code to generate working proof of concepts.

As such, having an IDE to check your code for syntax errors and misspellings will likely save hours of frustration. (NOTE FROM THE AUTHOR: You are permitted to write these exploits in any language of your choosing; however, I recommend sticking with writing Python in the free Sublime Text IDE if you do not have a programming background.)

dnSpy – The AWAE does a fantastic job breaking down how to decompile .NET code, set breakpoints, and analyze functions in dnSpy. However, for those who would like to research this tool before starting the AWAE, check out these links:

• Codingo - Decompiling with dnSpy

• krypt0mux - Reverse Engineering .NET Applications

(NOTE FROM THE AUTHOR: I had no prior knowledge of this application and found that the course provided more than enough material to feel comfortable.)

Reverse Shells – The ultimate goal of web application exploitation is to achieve remote code execution (RCE). For those without a penetration testing background or knowledge of the OSCP, take steps to learn how reverse shells can be uploaded and executed on a webserver. Before the course, understand the types of shells, their targeted frameworks, and their dependencies.

• Reverse Shell Cheat Sheet

• Upload Insecure Files