OSCE³ and OSEE Study Guide

OSWE

Content

• Web security tools and methodologies
• Source code analysis
• Persistent cross-site scripting
• Session hijacking
• .NET deserialization
• Remote code execution
• Blind SQL injections
• Data exfiltration
• Bypassing file upload restrictions and file extension filters
• PHP type juggling with loose comparisons
• PostgreSQL Extension and User Defined Functions
• Bypassing REGEX restrictions
• Magic hashes
• Bypassing character restrictions
• UDF reverse shells
• PostgreSQL large objects
• DOM-based cross site scripting (black box)
• Server side template injection
• Weak random token generation
• XML External Entity Injection
• RCE via database Functions
• OS Command Injection via WebSockets (BlackBox)

Study Materials

1. timip-GitHub- Reference guide
2. noraj-GitHub - Reference guide
3. wetw0rk-Github - Reference guide
4. kajalNair-Github - Reference guide
5. s0j0hn-Github - Reference guide
6. deletehead-Github - Reference guide
7. z-r0crypt - Reference guide
8. rayhan0x01 - Reference guide
9. Nathan-Rague - Reference guide
10. Joas Content - Reference guide
11. Lawlez-Github - Reference guide
12. 0xb120 - Reference Guide
13. Jaelkoh
14. snoopysecurity - Reference Guide
15. aaidanquimby - Reference Guide

Vulnerabilities

1. XXE Injection
2. CSRF
3. Cross-Site Scripting Exploitation
4. Cross-Site Scripting (XSS)
5. Unrestricted File Upload
6. Open Redirect
7. Remote File Inclusion (RFI)
8. HTML Injection
9. Path Traversal
10. Broken Authentication & Session Management
11. OS Command Injection
12. Multiple Ways to Banner Grabbing
13. Local File Inclusion (LFI)
14. Netcat for Pentester
15. WPScan:WordPress Pentesting Framework
16. WordPress Pentest Lab Setup in Multiple Ways
17. Multiple Ways to Crack WordPress login
18. Web Application Pentest Lab Setup on AWS

Reviews

1. OSWE Review - Portuguese Content
2. 0xklaue
3. greenwolf security
4. Cristian R
5. 21y4d - Exam Reviews
6. Marcin Szydlowski
7. Nathan Rague
8. Elias Dimopoulos
9. OSWE Review - Tips & Tricks - OSWE Review - Tips & Tricks
10. Alex-labs
11. niebardzo Github - Exam Review
12. Marcus Aurelius
13. yakuhito
14. donavan.sg
15. Alexei Kojenov
16. (OSWE)-Journey & Review - Offensive Security Web Expert (OSWE) - Journey & Review
17. Patryk Bogusz
18. svdwi GitHub - OSWE Labs POC
19. Werebug.com - OSWE and OSEP
20. jvesiluoma

Extra Content

1. OSWE labs - OSWE labs and exam's review/guide
2. HTB Machine
3. Deserialization
4. B1twis3
5. jangelesg GitHub
6. rootshooter
7. svdwi

OSEP

Content

• Operating System and Programming Theory
• Client Side Code Execution With Office
• Client Side Code Execution With Jscript
• Process Injection and Migration
• Introduction to Antivirus Evasion
• Advanced Antivirus Evasion
• Application Whitelisting
• Bypassing Network Filters
• Linux Post-Exploitation
• Kiosk Breakouts
• Windows Credentials
• Windows Lateral Movement
• Linux Lateral Movement
• Microsoft SQL Attacks
• Active Directory Exploitation
• Combining the Pieces
• Trying Harder: The Labs

Study Materials

• OSEP Code Snippets
• Experienced Pentester OSEP
• OSEP Pre
• PEN 300 OSEP Prep
• OSEP Thoughts
• OSEP Code Snippets README
• Osep
• Google Drive File
• Awesome Red Team Operations
• OSEP Study Guide 2022 - João Paulo de Andrade Filho
• OSEP PREP Useful Resources Payloads
• OSEP in3x0rab13
• OSEP forsec

Reviews

• nullg0re
• SpaceRaccoon Dev
• HackSouth YouTube
• Schellman
• Cinzinga
• YouTube iUPyiJbN4l4
• BorderGate
• Reddit OSEP Review
• Reddit OSCP Review
• Purpl3F0xSecur1ty
• MakoSecBlog
• YouTube iUPyiJbN4l4
• YouTube 15sv5eZ0oCM
• YouTube 0n3Li63PwnQ
• YouTube BWNzB1wIEQ
• SpaceRaccoon Dev
• Cas van Cooten
• BorderGate
• MakoSecBlog
• David Lebr1 GitBook
• Offensive Security

Labs

• SpaceRaccoon Dev - OSEP Review and Exam
• Exploit-DB - Evasion Techniques Breaching Defenses
• OSCP Exam Report Template Markdown
• Offensive Security - OSEP Exam FAQ
• CyberEagle - OSEP Review
• PentestLab - Defense Evasion
• PentestLab - Antivirus Evasion
• PentestLaboratories - Process Herpaderping Windows Defender Evasion
• YouTube - PentesterAcademyTV
• YouTube - PacktVideo
• YouTube - PentesterAcademyTV
• GitHub - In3x0rabl3/OSEP
• GitHub - timip/OSEP

OSED

Content

• WinDbg tutorial
• Stack buffer overflows
• Exploiting SEH overflows
• Intro to IDA Pro
• Overcoming space restrictions: Egghunters
• Shellcode from scratch
• Reverse-engineering bugs
• Stack overflows and DEP/ASLR bypass
• Format string specifier attacks
• Custom ROP chains and ROP payload decoders

Study Materials

• snoopysecurity - OSCE Prep
• epi052 - OSED Scripts
• Exploit-DB - Windows User Mode Exploit Development
• r0r0x-xx - OSED Pre
• sradley - OSED
• Nero22k - Exploit Development
• YouTube - 7PMw9GIb8Zs
• YouTube - FH1KptfPLKo
• YouTube - sOMmzUuwtmc
• ExploitLab Blog
• Azeria Labs - Heap Exploit Development Part 1
• ZeroKnights - Getting Started Exploit Lab
• Google Drive File 1
• Google Drive File 2
• Google Drive File 3
• Corelan - Exploit Writing Tutorial Part 1: Stack Based Overflows
• wtsxDev - Exploit Development
• corelan - Corelan Training
• subat0mik - Journey to OSCE
• nanotechz9l - Corelan Exploit Tutorial Part 1: Stack Based Overflows

Reviews

• YouTube - aWHL9hIKTCA
• YouTube - 62mWZ1xd8eM
• ihack4falafel - Offensive Security AWEOSEE Review
• LinkedIn - Advanced Windows Exploitation (OSEE) Review - Etizaz Mohsin
• Animal0day - Reviews for OSCP, OSCE, OSEE, and Corelan
• AddaxSoft - Offensive Security Advanced Windows Exploitation (AWE/OSEE) Review
• jhalon - OSCE Review
• YouTube - NAe6f1_XG6Q
• SpaceRaccoon - ROP and Roll EXP-301 Offensive Security Exploit Development (OSED) Review
• kuhi.to - OFFSEC EXP301 OSED Review
• epi052 - Windows Usermode Exploit Development Review
• SpaceRaccoon - ROP and Roll EXP-301 Offensive Security Exploit Development (OSED) Review
• YouTube - NAe6f1_XG6Q
• LinkedIn - Offensive Security Certified Expert 3 (OSCE3) - Cristian Cornea
• NOP Blog - OSED
• Deep Hacking - OSED Review
• OSED Review – Navigating The Shadows

Labs

• CyberSecurityUP - Buffer Overflow Labs
• ihack4falafel - OSCE
• nathunandwani - CTP OSCE
• sufyandaredevil - OSED - Exploiting SEH Overflows
• firmianay - Life-long Learner - SEED Labs - Buffer Overflow Vulnerability Lab
• wadejason - Buffer Overflow Vulnerability Lab
• Jeffery-Liu - Buffer Overflow Vulnerability Lab
• mutianxu - SEED LAB - Buffer Overflow Attack
• INE - Windows Exploit Development
• Connor McGarr - Browser Exploit
• Coalfire Blog - The Basics of Exploit Development
• Pentest Magazine - Exploit Development Windows
• Steflan Security - Complete Guide to Stack Buffer Overflow (OSCP)
• Offensive Security - EVOCAM Remote Buffer Overflow on OSX
• Exploit-DB - Exploit 42928
• Exploit-DB - Exploit 10434
• OCW CS PUB RO - Lab 08
• epi052 - OSED Scripts

OSEE

Content

• Bypass and evasion of user mode security mitigations such as DEP, ASLR, CFG, ACG and CET
• Advanced heap manipulations to obtain code execution along with guest-to-host and sandbox escapes
• Disarming WDEG mitigations and creating version independence for weaponization
• 64-Bit Windows Kernel Driver reverse engineering and vulnerability discovery
• Bypass of kernel mode security mitigations such as kASLR, NX, SMEP, SMAP, kCFG and HVCI

Study Materials

• Advanced Windows Exploitation (OSEE) Review – Etizaz Mohsin
• State of Exploit Development Part 2 – CrowdStrike
• BlackHat – Windows Kernel Exploitation (Video)
• NCC Group – Windows Exploit Mitigations
• Sandbox Escapes Collection – TechnoHerder
• Zero Day Initiative – Kernel Exploitation (1)
• Zero Day Initiative – Kernel Exploitation (2)
• BlackHat – Bypassing Modern Windows Protections
• VirtualBox E1000 0-Day
• Palantir – Assessing Effectiveness of Defender Exploit Guard
• ExploitGuard – Palantir GitHub
• Windows Classic Samples – Microsoft
• How to Hook Windows API using C++
• Windows API with Python
• Windows API for Pentesting – int0x33

Reviews

• AWEOSEE Review – ihack4falafel
• Advanced Windows Exploitation Review – Richard Osgood
• OSEE Review Video – David Alves
• My Offensive Security Journey – 0xInyiak
• OSEE Review
• OSEE Review by Jake Mayhew
• Journey OSEE
• OSEE Ultimate Guide

Labs

• EXP-401-OSEE – BLACKHAT-SSG
• OSEE – timip
• OSEE – dhn
• AWE-OSEE-Prep – orangice
• AWE-OSEE-Prep – matthiaskonrath
• OSEE – ihack4falafel
• OSEE – gscamelo
• 3XPL01t5 – w4fz5uck5
• CWDE - Red Team Leaders

OSCE³ OffSec Resources

• OffSec Courses Tools

Social Network

Joas Antonio - Linkedin

CyberSceurityUP- GitHub

C0d3Cr4zy - Twitter

Filipi Pires - Linkedin

Filipi Pires - GitHub

Filipi Pires - Twitter