OffSec OSWA Study Roadmap

Domain 1: Web app architecture (HTTP protocol, Burp Suite setup, proxy configuration)

Domain 1: Application mapping (Technology fingerprinting, endpoint enumeration, API testing)

Domain 2: XSS fundamentals (Reflected, stored, DOM-based XSS identification)

Domain 2: Advanced XSS (Filter bypass, CSP evasion, payload crafting, cookie theft)

Domain 3: SQL injection basics (Detection, UNION-based, error-based extraction)

Domain 3: Advanced SQLi. Blind techniques (boolean/time-based), sqlmap, WAF bypass

Domain 4: Authentication attacks (Bypass techniques, brute force, credential stuffing)

Domain 4: Session attacks (Fixation, hijacking, JWT attacks, CSRF exploitation)

Domain 5: File inclusion (LFI/RFI exploitation, PHP wrappers, log poisoning)

Domain 5: Server-side attacks (SSRF, file upload exploits, command injection, XXE)

Lab Practice: Full web application assessments, timed exercises, report writing

Final Review: Weak areas, mock exam practice, exam preparation