# OSWA (WEB-200) Study Path

> An independent, structured study path aligned with the OSWA® (WEB-200) exam syllabus, covering black-box web application attacks: XSS, SQL injection, XXE, SSTI, command injection, SSRF, IDOR, CORS, and directory traversal.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path
- **Vendor:** OffSec
- **Code:** WEB-200
- **Difficulty:** Intermediate
- **Exam duration:** 23 hours 45 minutes + 24-hour report window
- **Exam passing score:** 70 / 100 points
- **Exam targets:** 5 independent web app targets, each with local.txt + proof.txt
- **Exam objective:** Gain an authenticated admin session and read proof.txt; no privilege escalation required
- **Exam emulated users:** Some targets simulate users you can attack (e.g. stored XSS)
- **Exam machine reverts:** 24 reverts, resettable once
- **Exam allowed tooling:** Nmap/NSE, Nikto, Burp (Community/Pro), DirBuster, SQLMap, Tplmap, msfvenom, ysoserial
- **Exam restrictions:** No spoofing, commercial tools, auto-exploit frameworks, mass scanners, or AI chatbots
- **Exam proctoring:** Proctored via webcam + screen sharing
- **Exam certification:** OSWA (OffSec Web Assessor)
- **Official syllabus:** https://cdn.sanity.io/files/t7y0tkf4/production/ab2f5e736fa44d010f0697f8db8fad149a9255e5.pdf?dl=WEB-200_FEB-2026.pdf
- **Practice machines:** https://hackindex.io/learn/oswa-web-200-study-path/machines.md
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

## Prepare for the OSWA® Exam with Free, Hands-On Study Material

The OffSec Web Assessor (OSWA®) is a hands-on certification focused on black-box web application security testing. It is earned by passing OffSec®'s WEB-200 exam, which validates that a candidate can discover and exploit common web vulnerabilities against live applications without access to source code, then document the findings in a professional report.

The WEB-200 exam syllabus covers a web application assessment methodology and the core vulnerability classes: cross-site scripting, cross-origin attacks, SQL injection, directory traversal, XML external entities, server-side template injection, command injection, server-side request forgery, and insecure direct object references. This study path organizes free HackIndex content around those topics in its own structure.

HackIndex is independent study material and is not affiliated with, endorsed by, or sponsored by OffSec. All content here is original: it maps to the public exam topics with real requests, payloads, and expected behavior, and links to OffSec's official pages as the authoritative source.

The OSWA® exam gives you 23 hours and 45 minutes to compromise 5 independent web application targets, followed by a 24-hour reporting window. Each target has a local.txt and a proof.txt, and the goal is an authenticated administrator session and remote access, with no privilege escalation required. You need 70 of 100 points to pass. Automated frameworks and mass scanners are banned, but SQLMap, Tplmap, and Burp are permitted, so a solid manual methodology is what the exam rewards.

> [!WARNING]
> This is still a work in progress. The modules still need to be set up and finished.

## Modules

- [Getting Started: Web Assessment Workflow](https://hackindex.io/learn/oswa-web-200-study-path/introduction-to-web-200.md): How the WEB-200 web application assessment workflow maps to HackIndex content, and how to use this study path.
- [Web Application Enumeration](https://hackindex.io/learn/oswa-web-200-study-path/web-application-enumeration-methodology.md): Fingerprint the stack, crawl and map the app, discover hidden content, endpoints, parameters, and enumerate CMS platforms.
- [Burp Suite Essentials](https://hackindex.io/learn/oswa-web-200-study-path/introduction-to-burp-suite.md): Set up the intercepting proxy and use Repeater, Intruder, Decoder, and Comparer to inspect, modify, and replay web traffic.
- [Cross-Site Scripting: Discovery](https://hackindex.io/learn/oswa-web-200-study-path/xss-introduction-and-discovery.md): Identify reflected, stored, and DOM-based XSS by finding where user input reaches an output context without proper encoding.
- [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study.md): Turn XSS into session theft, credential capture, and admin takeover, and bypass filters and CSP to land working payloads.
- [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks.md): Exploit CORS misconfigurations, cross-site request forgery, and clickjacking that abuse cross-origin trust and the victim's session.
- [SQL Fundamentals](https://hackindex.io/learn/oswa-web-200-study-path/introduction-to-sql.md): Understand SQL query structure, dialect differences across MySQL/MSSQL/PostgreSQL/Oracle, and how to detect an injectable parameter.
- [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection.md): Exploit SQL injection via UNION, error-based, blind, and stacked queries; automate with sqlmap; escalate to file read and RCE; plus NoSQL injection.
- [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks.md): Read arbitrary files via path traversal, escalate file inclusion (LFI/RFI) to RCE, and turn insecure file uploads into web shells.
- [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities.md): Discover and exploit XXE to read local files, pivot to SSRF, and exfiltrate data out-of-band through vulnerable XML parsers.
- [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection.md): Detect SSTI, fingerprint the template engine, and escalate to remote code execution across Jinja2, Twig, Freemarker, Pug, and Handlebars.
- [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection.md): Detect and exploit OS command injection on Linux and Windows, land a reverse shell, and bypass keyword and character filters.
- [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery.md): Discover and exploit SSRF to reach internal services, steal cloud metadata credentials, read local files, and bypass destination filters.
- [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing.md): Find and exploit IDOR and broken access control by tampering object references to reach other users' data and admin functionality.
- [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown.md): Run a full web assessment end to end: chain vulnerabilities, review source, and apply the additional attack classes that round out the OSWA skill set.

> [!NOTE]
> HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSWA® and OffSec® are registered trademarks of OffSec Services Limited. WEB-200 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.