Skip to content
HackIndex.io

Free study path · OffSec WEB-200

OSWA (WEB-200) Study Path

An independent, structured study path aligned with the OSWA® (WEB-200) exam syllabus, covering black-box web application attacks: XSS, SQL injection, XXE, SSTI, command injection, SSRF, IDOR, CORS, and directory traversal.

Modules
15
Resources
197
Study time
~28.25 h
Difficulty
Intermediate

Exam at a glance

Duration
23 hours 45 minutes + 24-hour report window
Passing score
70 / 100 points
Targets
5 independent web app targets, each with local.txt + proof.txt
Objective
Gain an authenticated admin session and read proof.txt; no privilege escalation required
Emulated users
Some targets simulate users you can attack (e.g. stored XSS)
Machine reverts
24 reverts, resettable once
Allowed tooling
Nmap/NSE, Nikto, Burp (Community/Pro), DirBuster, SQLMap, Tplmap, msfvenom, ysoserial
Restrictions
No spoofing, commercial tools, auto-exploit frameworks, mass scanners, or AI chatbots
Proctoring
Proctored via webcam + screen sharing
Certification
OSWA (OffSec Web Assessor)

Prepare for the OSWA® Exam with Free, Hands-On Study Material

The OffSec Web Assessor (OSWA®) is a hands-on certification focused on black-box web application security testing. It is earned by passing OffSec®'s WEB-200 exam, which validates that a candidate can discover and exploit common web vulnerabilities against live applications without access to source code, then document the findings in a professional report.

The WEB-200 exam syllabus covers a web application assessment methodology and the core vulnerability classes: cross-site scripting, cross-origin attacks, SQL injection, directory traversal, XML external entities, server-side template injection, command injection, server-side request forgery, and insecure direct object references. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics with real requests, payloads, and expected behavior, and links to OffSec's official pages as the authoritative source.

The OSWA® exam gives you 23 hours and 45 minutes to compromise 5 independent web application targets, followed by a 24-hour reporting window. Each target has a local.txt and a proof.txt, and the goal is an authenticated administrator session and remote access, with no privilege escalation required. You need 70 of 100 points to pass. Automated frameworks and mass scanners are banned, but SQLMap, Tplmap, and Burp are permitted, so a solid manual methodology is what the exam rewards.

Syllabus modules

Work through the modules in order. Each one explains the topic and links the content worth your time.

  1. 1

    Getting Started: Web Assessment Workflow

    How the WEB-200 web application assessment workflow maps to HackIndex content, and how to use this study path.

    No resources yet ~0.25 h

  2. 2

    Web Application Enumeration

    Fingerprint the stack, crawl and map the app, discover hidden content, endpoints, parameters, and enumerate CMS platforms.

    12 resources ~2 h

  3. 3

    Burp Suite Essentials

    Set up the intercepting proxy and use Repeater, Intruder, Decoder, and Comparer to inspect, modify, and replay web traffic.

    1 resource ~1 h

  4. 4

    Cross-Site Scripting: Discovery

    Identify reflected, stored, and DOM-based XSS by finding where user input reaches an output context without proper encoding.

    3 resources ~2 h

  5. 5

    Cross-Site Scripting: Exploitation

    Turn XSS into session theft, credential capture, and admin takeover, and bypass filters and CSP to land working payloads.

    17 resources ~2.5 h

  6. 6

    Cross-Origin Attacks

    Exploit CORS misconfigurations, cross-site request forgery, and clickjacking that abuse cross-origin trust and the victim's session.

    17 resources ~2 h

  7. 7

    SQL Fundamentals

    Understand SQL query structure, dialect differences across MySQL/MSSQL/PostgreSQL/Oracle, and how to detect an injectable parameter.

    2 resources ~1.5 h

  8. 8

    SQL Injection

    Exploit SQL injection via UNION, error-based, blind, and stacked queries; automate with sqlmap; escalate to file read and RCE; plus NoSQL injection.

    32 resources ~3 h

  9. 9

    Directory Traversal and File Inclusion

    Read arbitrary files via path traversal, escalate file inclusion (LFI/RFI) to RCE, and turn insecure file uploads into web shells.

    23 resources ~2.5 h

  10. 10

    XML External Entities

    Discover and exploit XXE to read local files, pivot to SSRF, and exfiltrate data out-of-band through vulnerable XML parsers.

    11 resources ~1.5 h

  11. 11

    Server-side Template Injection

    Detect SSTI, fingerprint the template engine, and escalate to remote code execution across Jinja2, Twig, Freemarker, Pug, and Handlebars.

    11 resources ~1.5 h

  12. 12

    Command Injection

    Detect and exploit OS command injection on Linux and Windows, land a reverse shell, and bypass keyword and character filters.

    12 resources ~2 h

  13. 13

    Server-side Request Forgery

    Discover and exploit SSRF to reach internal services, steal cloud metadata credentials, read local files, and bypass destination filters.

    9 resources ~2 h

  14. 14

    Insecure Direct Object References (IDOR)

    Find and exploit IDOR and broken access control by tampering object references to reach other users' data and admin functionality.

    12 resources ~1.5 h

  15. 15

    Full Web Application Assessment

    Run a full web assessment end to end: chain vulnerabilities, review source, and apply the additional attack classes that round out the OSWA skill set.

    35 resources ~3 h

  16. Complete the path

    15 modules to finish. Then test yourself on the practice machines below.

OSWA practice machines 120 machines mapped to the syllabus