The Offensive Security Web Expert (OSWE) is an advanced certification earned by completing the WEB-300: Advanced Web Attacks and Exploitation (AWAE) course. It focuses on white-box web application assessments, requiring you to perform deep source code analysis to discover and exploit complex vulnerabilities. Updated Course Content (New Topics)
1. Master the Prerequisites
Before even considering WEB-300, ensure you are comfortable with:
The "OSWE PDF" Trap
When users search for an OSWE PDF, they are usually looking for the official course guide (the "AWAE" or WEB-300 manual) or a leaked exam guide.
- Identify entry points, data flow from input to sink.
- Look for unsanitized user input reaching eval/system/DB/template renderers.
- Check auth logic for direct user ID usage, weak assumptions, or insecure token handling.
- Review file handling, path concatenation, and use of unsafe functions (system, exec, eval, unserialize).