EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Advanced Web Attacks and Exploitation

Course outline

WEB-30015 days
Discuss this programme →

Duration

WEB-300: Advanced Web Attacks and Exploitation

15 days (e-learning)

Overview

OffSec’s Advanced Web Attacks and Exploitation (WEB-300) course dives deep into the latest web application penetration testing methodologies and techniques. Learners gain extensive hands-on experience in a self-paced environment, designed to elevate their skills in ethical hacking, vulnerability discovery, and exploit development.

Successful completion of the online training course and challenging exam earns the OffSec Web Expert (OSWE) certification. This web application security certification validates expertise in advanced web application security testing, including bypassing defenses and crafting custom exploits to address critical vulnerabilities, making certified professionals an asset for securing any organization against web-based threats.

Benefits

Upon completing WEB-300 and successfully passing the OSWE exam, you’ll have mastered advanced web application security methodologies, including:

  • In-depth vulnerability analysis and exploitation
  • Custom exploit development
  • Bypassing modern web application defenses
  • Exploiting authentication and authorization flaws
  • Attacking API endpoints and cloud-native applications

About the exam

  • The WEB-300 course and online lab prepares you for the Offensive Security Web Expert (OSWE) exam
  • 48-hour exam
  • Proctored

Target Audience

The WEB-300 course is ideal for experienced penetration testers and security professionals seeking to master advanced web application attacks and exploitation techniques, ultimately earning the OSWE certification

Prerequisites

While there are no formal certification prerequisites, it’s strongly recommended that you have:

  • Comfort reading and writing at least one coding language
  • Familiarity with Linux
  • Ability to write simple Python / Perl / PHP / Bash scripts
  • Experience with web proxies
  • General understanding of web app attack vectors, theory, and practice

Introduction

  • Tools & Methodologies
  • ATutor Authentication Bypass and RCE
  • ATutor LMS Type Juggling Vulnerability
  • ManageEngine Applications Manager AMUserResourcesSyn cServlet SQL Injection RCE
  • Bassmaster NodeJS Arbitrary JavaScript Injection Vulnerability
  • DotNetNuke Cookie Deserialization RCE
  • ERPNext Authentication Bypass and Server Side Template Injection
  • openCRX Authentication Bypass and Remote Code Execution
  • openITCOCKPIT XSS and OS Command Injection – Blackbox
  • Concord Authentication Bypass to RCE
  • Server Side Request Forgery
  • Guacamole Lite Prototype Pollution
  • Conclusion

Programme scope, delivery arrangements and suitability are confirmed during enquiry.