Shortly after earning my OSCP I wanted to someday continue that push through the Cracking the Perimeter/OSCE certification as well. I never got around to it, and then OffSec retired that course while releasing AWAE(now WEB-300)/OSWE (and EXP-301/OSED), which I immediately also wanted to do. Part of my prep for a major certification is to Google up all sorts of reviews and posts about the certification and what other study materials and tips and insights other students found useful. This includes blogs, reddit posts, forum posts, and anything else that I could find or dig through. As such, I did plenty of this as preparation for the AWAE (WEB-300). I still plan to pursue this someday, but for now I wanted to share what I had compiled into my personal notes.

Some of these things I may have gained knowledge of through other less formal means over the past few years or just outright completed without really planning it, but AWAE is still pretty new and all of these resources are likely still relevant.

That said, never let too much preparation get in the way of getting access to the course and the labs for practice. You don’t just get sent off straight into an exam, and can always put that part off for later if some gaps in knowledge continue to linger.

Lastly, it should go without saying to click links below at your own discretion. All are external to this site.

My Goals

• level up my hands-on web app pentesting
• code review skills looking at vulnerabilities
• writing exploits for web app vulnerabilities
• actionable python (requests, etc)
• learn much more about .NET, C#, nodejs, php, and some more on java…enough to feel comfortable reading source code and tracing requests and parameters
• more familiarity with Visual Studio Code, debuggers

I do like to write out goals, as they do a few things for me. First, the goals help make sure I’m aligning my certification path and the preparation towards it with what I hope to get out of it. Second, it helps give me an idea what the certification path is all about, so that I can slot other possible preparation topics into it. In other words, managing expectations and summarizing the output.

This is my initial seeding of research and prep

• https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
• https://medium.com/@klockw3rk/offensive-security-advanced-web-attacks-and-exploitations-awae-what-you-need-to-know-349933b72d24
• https://www.reddit.com/r/OSWE/comments/k0gcrm/awaeoswe_review_from_nondeveloper_perspective/
• https://blog.kuhi.to/offsec-awae-oswe-review
• https://www.reddit.com/r/OSWE/comments/ioj8gb/passed_oswe_taking_questions/
• https://medium.com/greenwolf-security/an-awae-oswe-review-2020-update-6d6ec7a80c1f
• Java coding, PHP, Microsoft MVC, C#, JavaScript, Python web requests handling
• WAHH Ch 19 and 21
• https://www.offensive-security.com/documentation/awae-syllabus.pdf
• https://forum.hackthebox.eu/discussion/2646/oswe-exam-review-2020-notes-gifts-inside (+thread)
• https://www.reddit.com/r/OSWE/comments/i0p187/failed_my_first_attempt/
• https://z-r0crypt.github.io/blog/2020/01/22/oswe/awae-preparation/
• Maybe I should do websec academy from port swigger first? Also pentester academy.
• https://www.reddit.com/r/OSWE/comments/jyr7sj/source_code_revie_methodologies/
• https://www.youtube.com/watch?v=F46tQww_IvE
• https://stacktrac3.co/oswe-review-awae-course/
• https://github.com/wetw0rk/AWAE-PREP
• https://github.com/timip/OSWE
• https://www.youtube.com/watch?v=ElZ7fFE9Gr4

Preparation Checklist

This is my reviewing of the above items and setting up some semblance of a plan. Considering what this cert is, I definitely don’t see myself signing up for this until the latter half of 2021. Worst case scenario, I am not entirely prepared, but sign up for the course anyway and either put off or fail the exam. Either way, I still come out of that with some learning, and extra time (and less stress based on deadlines), and a good idea of my next steps.

General things I need to do:

• learn what MVC and OOP really mean
• Python, writing small scripts to deliver exploits, handle requests <–should be comfortable with this
• C#/.NET
• nodejs/Javascript
• php
• java
• learn debugging and decompiling tools, dnspy, de-gui
• regex
• more SQL injection
• do various vulnerable web apps
• Visual Studio Code
• SublimeText
• brush up on various in-scope web app vulnerabilities types
• comfortable debugging the above on Windows and Linux, or at least aware of techniques

Actual things to do

• check out practice labs: https://twitter.com/trouble1_raunak/status/1361652466006315010
• book: WAHH ch 19 and 21
• course: portswigger’s web app academy
• course: pentesterlab
  • pentesterlabs XSS-to-RCE exercise is very helpful
  • do other exercises again
  • do code review badge again?
• challenges: https://edabit.com/
• challenges: do wetw0rk php challenges before lab!
• challenges: do wetw0rk javascript challenges before lab!
• vuln app: do DVWA
  • writing python scripts for DVWA exercises
• vuln app: do bwapp (or bee-box for preinstalled VM)
• vuln app: owasp juice shop
• vuln app: vuln web apps like ospaykj? oscode for nodejs and oscode for c#?
• vuln app: https://wiki.owasp.org/index.php/Category:OWASP_Code_Review_Project
• vuln app: nodejs https://github.com/snoopysecurity/dvws-node
• vuln app: https://github.com/appsecco/dvna
• challenges: pentester academy WAP challenges
• book: check red team/blue team books on the languages or tools to be used
• book: check any other debugging books I have for tools, ways to decompile or debug apps
• book: check any other web app books I have
• challenges: TJNull’s playlist for OSWE: https://www.youtube.com/playlist?list=PLidcsTyj9JXKTnpphkJ310PVVGF-GuZA0
  • HTB list: https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/htmlview#
  • also HTB: https://github.com/s0j0hn/AWAE-OSWE-Prep
• challenges: some vulns to read up on or even practice: https://github.com/timip/OSWE
• challenges: https://hackxor.net/
• vuln app: OSCode for .NET framework? <–still not sure what this is
• read: https://owasp.org/www-project-security-knowledge-framework/
• compilation: https://www.yeahhub.com/vulnerable-web-mobile-os-projects/
• challenges: game of hacks http://www.gameofhacks.com/
• challenges: tryhackme – may be some relevant things here

Tools

• dnSpy – .NET decompiler
• Python requests and exploit building
  • know python requests inside and out, especially the session object
  • https://requests.readthedocs.io/en/master/
• de-gui for java?
• use Visual Studio Code regularly (many benefits; hotkeys and debugging, going to modules/references)
  • leverage Visual Studio Code SSH extensions
  • understand the launch_json files in Visual Code
• learn some SublimeText (for python)
• Burp (set scope, intercept requests, manipulate requests…)

Languages / major themes / skills

• c# .NET MVC
  • look into how MVC works
  • C# in an hour: https://www.youtube.com/watch?v=gfkTfcpWqAY
  • asp.net MVC in 1 hour: https://www.youtube.com/watch?v=E7Voso411Vs
  • https://codingo.io/reverse-engineering/ctf/2017/07/25/Decompiling-CSharp-By-Example-with-Cracknet.html
  • beg/advanced projects to review: https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
    watch: https://www.youtube.com/watch?v=Xfbu-pQ1tIc&list=PLwvifWoWyqwqkmJ3ieTG6uXUSuid95L33
  • learn how to debug applications, echo variables, trace, decompile if necessary, etc. (interpreted=print, compiled=step)
• nodejs -> javascript
  • nodejs crash course youtube (traversy media)
  • javascript for pentesters (Pentester academy)
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/JavaScript%20For%20Pentesters
  • beg/advanced projects to review: https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
  • learn how to debug applications, echo variables, trace, decompile if necessary, etc. (interpreted=print, compiled=step)
• java
  • beg/advanced projects to review: https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
  • https://techblog.mediaservice.net/2017/05/reliable-discovery-and-exploitation-of-java-deserialization-vulnerabilities/
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/Understanding%20Java%20Deserialization
  • learn how to debug applications, echo variables, trace, decompile if necessary, etc. (interpreted=print, compiled=step)
• know how URL routing works in each of the languages
• SQL scripting
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/From%20SQL%20Injection%20to%20Shell
• php
  • laravel (mvc) -> php – understanding routing
  • beg/advanced projects to review: https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/Understanding%20PHP%20Object%20Injection
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/%5Cdev%5Crandom:%20Pipe
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/XSS%20and%20MySQL
  • learn how to debug applications, echo variables, trace, decompile if necessary, etc. (interpreted=print, compiled=step)
  • learn how requests are routed
• learn what OOP is
  • https://github.com/wetw0rk/AWAE-PREP/tree/master/Simple%20Object%20Oriented%20Language%20Examples
• regex filtering/validation
  • https://regex101.com/
• django (mvc) -> python – understanding routing
• learn how to debug java, .net, php, and node on windows AND linux
• learning debugging, oop, mvc in java, nodejs, php, and c# (and how to read variables out of them)

General techniques to know about

• blind sql hunting (sqlmap)
• php type juggling
• common vuln examples: https://hub.schellman.com/blog/oswe-review-and-exam-preparation-guide
• reverse shells: https://highon.coffee/blog/reverse-shell-cheat-sheet/
• upload insecure files: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Upload%20Insecure%20Files
• read examples here: https://stacktrac3.co/oswe-review-awae-course/
• read examples here: https://z-r0crypt.github.io/blog/2020/01/22/oswe/awae-preparation/

Pre-course things to revisit before purchasing the course

• read the footnotes and links, do the extra miles!!!
• define a methodology: blackbox the app first, then white box source code (grep/ngrep?)
• set up kali and note strategy
• read offsec faqs and guidelines for course and exam

Lastly, make a list of things from the above to review halfway through the course, and another list to review before scheduling the exam.

Back in the early 2000s I often used my blog to hold notes, links, and things I’d consumed or done or would check deeper into or read or do. Over the years, this activity sort of moved away from being in a blog, and more to my own private notes, or into Pocket (never to be seen again!). I feel like some of this is the result of the growing avalanche of information at our fingertips from 2000 until now.

I’ve gotten to the point where I kinda want some of that stuff cycled out of my private notes, but not always entirely lost. Something I could possibly still search and re-reference, without maintaining my own mini-encyclopedia of topical notes and links and to-do lists. Honestly, sort of the same itch that a diary or journal serves for thoughts and experiences…or other blogs and feeds. And the same sort of thing that will just go away when I do as the domain/hosting expires. (See, that’s the good part of hosted blogs, like blogspot and blogger, right? They’ll stay around?)

So, maybe I should start to empty out a bunch of my private notes into my blog here! I mean, on the other hand, why not? And while not private, it’s not like a bunch of folks will read most anything I put in here. 🙂 I feel like the days of personal blog-popularity are long gone anyway.

I used to also have a personal wiki I hosted, but never really did too much with, that I could resurrect for some things. Or just move that sort of usage over to Github Wiki.

I don’t think I’ll ever use a blog as a “to-do” list, as that is way too suited to a notes app. But, I can at least have a way to trim things off without feeling like I’m forever losing a resource or reference. Thereby maybe regaining control of my “to-do” list! Let some things go, ya know?

Anyway, I’ll see how this goes.

Regularly over the years I’ve had opportunities to give advice and direction on new or growing cybersecurity folks. I like to point out books, certifications, courses, resources, and most importantly other practical activities to grow knowledge and confidence as we all forge career paths. I’ve recently discovered and been playing on the Blue Team Labs (BTLO) platform which has, as the name suggests, blue team-themed exercises, challenges, and labs. There are nearly 200 labs and standalone challenges on the site, some of which are very difficult while others are relatively simple to solve.

Rather than discuss the platform itself at length, Dimitry Bennett wrote an article about his experience on the BTLO platform that basically says all that needs said on the topic.

But, there is still one thing I thought was daunting about the platform: Where to start when one is pretty new to cybersecurity? And this is the challenge any time I talk to someone else about where they’ve come from and where they want to go. All of us bring to the table different levels of experience, knowledge, and comfort with various technical and even non-technical topics. Some of us are very inexperienced with Linux, or have never written a program or script before, or maybe have done very little Windows system administration, but know Linux like no one’s business. What I wanted was a quick cheat sheet on what to suggest to students who wanted to quickly get their hands into the BTLO labs without immediately hitting walls.

This page is meant to help me prescribe labs and challenges to security analysts I encounter that are looking to build particular skills or experience what common SOC tier expectations exist.

I do want to make clear that the SOC tier expectations and levels of knowledge is just my take on the subject. I’m not going to be correct on all of these, nor will I be correct for how every organization/environment defines the job duties and expectations of each tier. I’ve just given this a best effort in the context of the whole of the labs, since I’ve gone through every single one, and my own experiences over years in the IT and security industry.

I also want to make clear that BTLO does allow students a chance to see what they’re getting into. Every lab has a difficulty level set to it, the date it was released, the general tools expected to be present, and even the number of solves that have been recorded since the lab was released. All of these can also help guide students to maybe avoid things they may find frustrating.

Here is a quick key to some of the columns in my table.

• Diff(iculty): Difficulty 1-10, 10 being hardest. My personal subjective value of how difficult this exercise is. Usually this is influenced by how much effort and knowledge may be needed to complete.
• SOC: My gut feel on what SOC analyst tier level I would expect to complete these exercises. Some tasks are pretty normal for tier 1 SOC analysts, whereas some of the more involved analysis may be reserved for higher tiers. I add a “+” if this task kinda overlaps into a higher tier. As an example, analyzing an image of live system memory or a PE executable file is typically reserved for more experienced analysts.
• Skills: My summary of the tools needed. If you don’t know Wireshark and want to learn more, then look at the easier Wireshark exercises. Of particular note, I make sure to list an OS if knowledge of or comfort using that OS is a huge help in solving the exercise. Adding “administration” to the OS is my way of saying that experience being an administrator of this server would be very helpful.
• Notes: My very quick reminder about what the main point of this is.

INVESTIGATIONS (by difficulty & SOC level)

CHALLENGES (by difficulty & SOC level)

NAME	DIFF	SOC	SKILLS	NOTES
D3FEND	1	1	Google (D3FEND Framework)	Looking up things in the D3FEND material online
ATT&CK	1	1	Google (MITRE ATT&CK Framework)	Looking up things in the ATT&CK material online
The Report	1	1	PDF reader	Looking up things in MITRE report (pdf)
Phishing Analysis 2	2	1	Text editor, Thunderbird	Analyzing a phishing email
Phishing Analysis	2	1	Text editor, Thunderbird	Basic phishing email analysis
Meta	2	1	Exiftool, OSINT	Analyzing some basic info from image files
Brute Force	3	1	Linux, text editor, grep	Analyzing logs of an RDP brute force attack
The Planet’s Prestige	3	1+	Email client, text editor	Analyzing malicious email plus office type attachments
Suspicious USB Stick	3	1+	Linux, peepdf, strings, VirusTotal, hex editor	Basic analysis of a malicious PDF
Powershell Analysis – Keylogger	3	2	Powershell, Text editor	Analysis of a malicious PowerShell script
Log Analysis – Privilege Escalation	3	2	Linux, bash	Identifying malicious commands in a bash log
Network Analysis – Malware Compromise	4	2	Wireshark	Answering some basic questions based on a pcap
Log Analysis – Sysmon	4	1+	Sysmon, Windows, Powershell	Using sysmon logs to answer incident questions
Malware Analysis – Ransomware Script	4	2	Text editor, Linux	Analyzing bash script for ransomware
Log Analysis – compromised WordPress	4	2	Linux, Apache logs	Analyzing a web attack from Apache logs on Linux
ILOVEYOU	4	2+	Windows, text editor, sysinternal, regshot	Dynamic non-PE malware analysis
Follina	4	2	Windows, OSINT, text editor	Analysis of multi-stage maldoc 0-day
Melissa	5	2+	Oledump, text editor	Non-PE malware analysis
Shiba Insider	5	2	Wireshark, Steghide, Exiftool, Linux	Unwrapping layers of hidden data and common artifacts
Network Analysis – Web Shell	5	2	Wireshark, Linux and attacker knowledge	Analyzing a Linux attack using a pcap
Malicious Powershell Analysis	5	2	Powershell	Parsing a Powershell script and basic obfuscation
Spectrum	6	2	Fcrackzip, Photorec, Audacity, efitool, steghide	Unwrapping layers of hidden data in less common artifacts
Employee of the Year	6	2	Photorec, scalpel, CyberChef, Linux, strings	Recovering and unwrapping various file types
Network Analysis – Ransomware	6	2	Wireshark, OSINT	Analyzing and even recovering files using a pcap artifact
Memory Analysis – Ransomware	7	2+	Volatility, Windows, OSINT	Mostly entry level volatility analysis of memory image
Paranoid	7	2	Linux	Analysis of linux logs to answer incident questions
Secure Shell	7	2	Linux, text editor, OSINT	Analysis of an SSH log
The Package	7	CTF	OSINT, CTF, Math/Python	Don’t recommend. Clever CTF-Like math riddle.
Reverse Engineering – Another Injection	7	3	IDA (Disassembler), Sysinternals, API Monitor	PE analysis and debugging, not entry level, but close to it for malware analysis anyway
Barcode World	8	CTF	Linux, Python	Decode flag from 9000+ image files; don’t recommend
Browser Forensics – Cryptominer	8	2+	Linux, FTK Imager, Javascript, Windows	Analyzing image file for browser artifacts
Reverse Engineering – A Classic Injection	8	3	IDA, Sysinternals, Windows	Static and dynamic analysis of a PE file
Injection Series – Part 3	8	3	IDA, Sysinternals, Windows	Static and dynamic analysis of a PE file
Squid Game	8	CTF	Steghide, image editor	CTF-like image stego; don’t recommend
Injection Series Part 4	8	3	IDA, Ghidra	PE analysis using debugger
Secrets	8	Red	Python, JWT, Linux probably	Red team web app attack against weak jwt
Veriarty	8	CTF	Hashcat, Veracrypt, Linux, Thunderbird, gpg	Recovery and decoding of files; don’t recommend
D-Crypt	9	CTF	Browserlings	Decoding a string several times with minimal guidance
P2SEC – Minigame	9	Red	Web App attacking, OSINT, exiftool, PE analysis	Unguided multi-stage mostly red team basics; long
Classical City	10	CTF	Sanity	Decoding ciphers – don’t recommend