OffSec OSWE Study Roadmap

Domain 1: Source code review fundamentals (Data flow, taint tracking, code auditing methodology)

Domain 1: Language-specific patterns (PHP, Java, Python, .NET vulnerability patterns)

Domain 2: Authentication bypass (Type juggling, loose comparison, JWT manipulation)

Domain 2: Advanced auth attacks (Custom auth implementations, role manipulation, SSO bypass)

Domain 3: Advanced SQLi (Source-level identification, parameterized query bypass, ORM injection)

Domain 3: NoSQL injection (MongoDB, second-order SQLi, out-of-band extraction)

Domain 3: Custom exploit scripting (Python scripts for automated data extraction)

Domain 4: Deserialization (Java deserialization, ysoserial, gadget chain construction)

Domain 4: PHP/NET deserialization (Object injection, PHPGGC, .NET gadgets, magic methods)

Domain 5: SSTI (Jinja2, Twig, Freemarker, Thymeleaf exploitation and sandbox escapes)

Domain 5: RCE techniques (Exploit chaining, file write RCE, custom exploit development)

Lab Practice: Source code review exercises, vulnerability identification drills

Lab Practice: Full application assessments, exploit development, chaining attacks

Lab Practice: Timed mock exam (Complete application compromise with report)

Report Writing: Professional report writing practice, methodology documentation

Final Review: Weak areas, exam strategy, tool preparation