Work — Oswe Exam Report

Document the manual proof of concept (PoC) using Burp Suite or curl.

The unserialize() is called on attacker-controlled $token before the signature check. A PHP object with a __wakeup() or __destruct() method can execute arbitrary code.

Explain the final link in the chain that allowed code execution. oswe exam report work

Break down the exact vulnerabilities discovered within the codebase.

Your report must be self-contained, professional, and clear. OffSec provides an official exam report template, which you should use as your foundation. A successful report must include the following core sections. 1. Executive Summary Document the manual proof of concept (PoC) using

: Detailed explanations of each identified flaw, including the specific vulnerable source code and how it was discovered.

Create a template before you start the exam. Here is a proven structure: Explain the final link in the chain that

Screenshots showing the successful execution (e.g., whoami output, reading proof.txt ). 3. Best Practices for OSWE Exam Report Work Clear and Reproducible Steps Do not assume the examiner knows what you did. Bad: "I exploited the SQLi and got a shell."

Structuring your report correctly is only half the battle. The quality of your writing and the clarity of your explanations will determine whether your report passes review. Maintain a Strict Chronological Flow

Before showing your automation, prove you understand the exploit path manually.