OSWE | Advanced Web Attacks and Exploitation (WEB-300)

How an attacker manipulates JavaScript's inheritance model to inject malicious data, compromise application logic and execute code remotely.

• JavaScript prototypes and inheritance
• Injecting attacker-controlled data through a polluted prototype
• Taking prototype pollution through to remote code execution

Using SSRF to bypass filters, reach internal resources and attack complex application architectures.

• Bypassing filters that are meant to stop SSRF
• Accessing internal resources through the vulnerable server
• Exploiting SSRF in complex, multi-service applications

The tools and working methods the course relies on throughout.

• Fuzzing
• Static analysis
• Dynamic analysis
• Manual code review

Reading source code and following application logic to find attack vectors and security vulnerabilities.

• Parsing application logic from the source
• Identifying potential attack vectors
• Recognising vulnerable code

How attackers store malicious code on a web server so that it runs against many users over time.

• How a stored XSS payload reaches the server
• Attacking several users with one stored payload

How attackers take over user sessions to reach sensitive data and functionality.

• Taking over another user's session
• Using a hijacked session to access data and functions

The ways attackers exploit vulnerabilities caused by deserialization in .NET applications.

• Serialization and deserialization in .NET
• Identifying unsafe deserialization in an application
• Exploiting deserialization flaws

The techniques attackers use to run system-compromising code on a targeted web server.

• Routes from a web vulnerability to code execution
• Running code on the target web server

Techniques for exploiting SQL injection to compromise a database when the application gives no direct feedback.

• Recognising SQL injection without visible output
• Different techniques for extracting data blind
• Compromising the database through the injection

How attackers extract sensitive data from web applications.

• Exfiltration through SQL injection
• Exfiltration through XXE attacks
• Exfiltration through compromised file uploads

How attackers get past the mechanisms meant to stop malicious files from being uploaded.

• How upload restrictions work
• Bypassing file extension filters
• Uploading a malicious file despite the checks

Exploiting type juggling and loose comparison behaviour in PHP to bypass authentication.

• Loose and strict comparisons in PHP
• How PHP converts values between types
• Bypassing authentication with a loose comparison

How attackers use PostgreSQL extensions and user-defined functions to read private data, execute commands and set up persistent backdoors.

• PostgreSQL extensions
• User-defined functions (UDFs)
• Command execution and backdoors through the database

Evading regex-based input validation to inject malicious payloads into web applications.

• How regex-based input validation works
• Evading the validation pattern
• Delivering a payload past the filter

Bypassing authentication and performing unauthorised actions by exploiting "magic hashes" in PHP applications.

• What a magic hash is in PHP
• Using magic hashes to bypass authentication

Techniques for getting past character restrictions so that a payload can still be injected and the application's behaviour changed.

• Working out which characters are restricted
• Building payloads that avoid them

Using user-defined functions to create a reverse shell and reach the underlying operating system.

• Creating a user-defined function for a shell
• Getting a reverse shell on the database host

How attackers abuse large objects in PostgreSQL to store and execute malicious code and to exfiltrate data.

• Large objects in PostgreSQL
• Storing and executing code through large objects
• Exfiltrating sensitive data

How the browser's Document Object Model (DOM) can be manipulated to run malicious JavaScript without direct server-side interaction. This topic is taught black box, without source code.

• The DOM and how DOM-based XSS arises
• Finding DOM-based XSS without access to source
• Executing JavaScript in the victim's browser

Identifying and exploiting vulnerabilities in server-side templates to execute code remotely, disclose information or escalate privileges.

• Identifying template injection
• Remote code execution through a template
• Information disclosure and privilege escalation

The risks of poorly implemented random token generation and how attackers exploit it to compromise user sessions.

• Why weakly generated tokens are predictable
• Exploiting weak tokens to compromise a session

How attackers exploit weaknesses in XML parsers to access files, execute commands or cause denial of service, and how XXE can be prevented.

• XML parsers and external entities
• Reading files and executing commands through XXE
• Preventing XXE vulnerabilities

How vulnerabilities in database functions can be exploited to execute arbitrary code on the server.

• Database functions that can be abused
• Executing arbitrary code on the server through them

Identifying WebSocket vulnerabilities that allow operating system commands to be injected, giving control of the underlying server. This topic is taught black box.

• How the application uses WebSockets
• Injecting OS commands through a WebSocket
• Mitigating the vulnerability