OSWA Exam Review

Offensive Security Web Assessor (OSWA) is a certificate that provides you with the practical skills to perform a security assessment on a web application. You learn the most common web application vulnerabilities, how they work and how you can exploit them such as SQL injection, XSS, SSTI, and more. The certificate is focused on being practical, a hands-on keyboard approach where you have to get your hands dirty by doing labs.

What will you learn?

Some of the topics covered in the course are listed below:

• CORS Misconfigurations
• Cross-Site Scripting
• SQL Injection
• Directory Traversal
• XML Enternal Entities
• Server-side Template Injection
• Command Execution
• IDOR
• Server-side Request Forgery

Pros

• Offensive Security has a great reputation in the industry, so this certification will look really good on your resume.
• Up to date contents
• Funny labs with interesting techniques to capture flags

Cons

• The course don’t include all web app attacks as PortSwigger’s Web Security Academy.

Useful links/resources

PortSwigger’s Web Security Academy: https://portswigger.net/web-security

Exam

The OSWA exam itself consists of two parts, the first part is hacking 5 applications and finding at least 7 out of the 10 flags by exploiting the vulnerabilities. Each application contains two flags, where the first flag local.txt can be found by accessing the admin panel and the second flag proof.txt can be found on the server. You’re provided with 23 hours and 45 minutes of access to the exam lab environment. The second part is writing a professional penetration test report, you have to submit this report within 24 hours after the access to the exam lab has expired.

Final thougts

I can say that I learned a lot about OSWA exam and web-200 course but to get an overall view of all the types of web attacks I recommend PortSwigger’s Web Security Academy.