Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Advanced Web Attacks and Exploitation
Advanced Web Attacks and Exploitation (WEB-300) is an advanced web application security review course that teaches the skills needed to conduct white box web app penetration tests. This course can be taken as an option for skills specialization after completing PEN-200, but students should be comfortable reading and writing code in at least one language. Students who complete the course and pass the exam earn the Offensive Security Web Expert (OSWE) certification, demonstrating mastery in exploiting front-facing web apps. The OSWE is one of three certifications making up the new OSCE³ certification, along with the OSEP for advanced pen testing and the OSED for exploit development.
Course Overview
- Comfort reading and writing at least one coding language (Java, .NET, JavaScript, Python, etc.)
- Familiarity with Linux: file permissions, navigation, editing and running scripts
- Ability to write simple Python / Perl / PHP / Bash scripts
- Experience with web proxies such as Burp Suite and similar tools
- General understanding of web app attack vectors, theory and practice
8890 McGaw Road
Suite 200
Columbia, MD 21045
625 W Adams Street
Chicago, IL 60661
5908 Headquarters Drive
Suite 400
Plano, TX 75024
201 N Franklin St
Floor 37
Tampa, FL 33602
40 E. Rio Salado Parkway
Suite 200
Tempe, AZ 85281
- Providers
- Courses
- Course and Provider Quantity
Learning Objectives
- Perform a deep analysis on decompiled web app source code
- Identify logical vulnerabilities that many enterprise scanners are unable to detect
- Combine logical vulnerabilities to create a proof of concept on a web app
- Exploit vulnerabilities by chaining them into complex attacks
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Competency Areas
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.