# Getting Started: Web Assessment Workflow

> How the WEB-200 web application assessment workflow maps to HackIndex content, and how to use this study path.

- **URL:** https://hackindex.io/learn/oswa-web-200-study-path/introduction-to-web-200
- **Certification:** [OSWA (WEB-200) Study Path](https://hackindex.io/learn/oswa-web-200-study-path.md)
- **Estimated study hours:** 0.25
- **Published:** 2026-09-26
- **Updated:** 2026-09-27

A web application assessment follows a repeatable workflow. You map the application, enumerate its inputs and endpoints, identify which vulnerability classes apply, exploit them to reach an authenticated administrator session, and capture proof. Every step feeds the next. This page covers how that workflow maps to HackIndex content, so you know where to find what you need as you work through the OSWA study path.

## Web Application Assessment Methodology

WEB-200 teaches a black-box methodology: you have no source code, only the running application. The flow is:

- **Mapping**: fingerprint the stack, spider the application, and catalog every page, parameter, header, and cookie. Proxy all traffic through Burp Suite.
- **Enumeration**: find hidden content, endpoints, and functionality. Directory and vhost discovery, parameter discovery, and reviewing client-side code.
- **Vulnerability Discovery**: test each input against the vulnerability classes: XSS, SQL injection, directory traversal, XXE, SSTI, command injection, SSRF, IDOR, and CORS misconfiguration.
- **Exploitation**: turn a confirmed weakness into an authenticated admin session or remote code execution on the server.
- **Proof**: retrieve local.txt from the application's admin area and proof.txt from the server file system. No privilege escalation is required on the OSWA exam.

## How HackIndex Is Organized

Content on HackIndex is organized around two axes: **what you are attacking** and **what phase you are in**.

### Services and Platforms

Each technology has its own section. Web application content lives under the **web** service: HTTP-facing attacks, injection classes, and client-side techniques. Supporting services that often back a web app (databases, caching, upload handlers) have their own sections and are cross-referenced where an attack chains through them.

### Phases

Within the web service, content is grouped by phase: Enumeration, Vulnerability Discovery, Exploitation, and Post-Exploitation. When you map an application and want to know what to look for, you go to **web > enumeration**. When you confirm an injection point and need the exploitation steps, you go to **web > exploitation**.

### Articles

Each article covers a specific technique, payload, or attack. Articles contain working requests and payloads with placeholder variables (`$TARGET`, `$URL`, `$PARAM`), realistic responses, and the reasoning for interpreting them. The focus is on what to send and how to read the result, not theory.

## Using This Study Path

The OSWA study path maps WEB-200 topics to HackIndex content. Each module page lists the relevant articles that cover the same skills. It is not a replacement for the official course material, but a free reference with practical payloads and techniques for every exam topic. Start with the vulnerability classes you are weakest in. If you can discover and exploit a class end-to-end on a practice application using only these pages, you have the skill level the exam expects for that topic.

> [!NOTE]
> The OSWA exam is black-box and tests manual skills. Automated tools like SQLMap are allowed, but you must understand the underlying vulnerability, craft payloads by hand when tools fall short, and chain findings to reach an admin session. Focus on understanding each class, not memorizing payloads.

## References

- [OffSec: WEB-200 Course Overview](https://www.offsec.com/courses/web-200/) - Official course page with module descriptions and prerequisites.
- [OSWA Exam Guide](https://help.offsec.com/hc/en-us/articles/4410105650964-WEB-200-Foundational-Web-Application-Assessments-with-Kali-Linux-OSWA-Exam-Guide) - Exam rules, scoring, tool restrictions, and report requirements.