Oswe Exam Report -
Include 10 lines above and below the vulnerable code. Failure #3: Forgetting the “White-Box” Rule Do not write the report as if you discovered the vulnerability via fuzzing. Say: “While reviewing routes.php, the application fails to validate the ‘action’ parameter before passing it to call_user_func_array().” Failure #4: Poor Screenshot Hygiene Blurry images, terminal text too small, or screenshots that edit out critical error messages. OffSec requires clear, readable proofs.
Use Shift+Ctrl+PrtScn (Windows) or Shift+Cmd+4 (Mac). Paste into the document at full size. Advanced Tips for the OSWE Exam Report Use a Template (But Customize It) Offensive Security does not provide a mandatory template for OSWE (like they do for OSCP). However, you should build one in Markdown (converted to PDF) or Microsoft Word with styles.
Explain step-by-step how user input flows from the entry point (e.g., a $_POST['file'] parameter) to a sink function (e.g., include() or system() ). OSWE examiners look for this “taint flow” analysis. oswe exam report
Your goal is to provide a document that allows Offensive Security’s lab team to verify your findings.
Example: Line 12: $template = $_GET['theme']; – User input unsanitized. Line 45: include($template . '.php'); – Leading to Local File Inclusion (LFI). You must provide a working Python or Ruby exploit script. The examiner will run this script against their pristine exam environment. If it fails, you fail. Ensure the script is self-contained (no hardcoded absolute paths unless necessary) and includes comments. Include 10 lines above and below the vulnerable code
/modules/core/logic.class.php, lines 88-94
Treat the report as a separate, 24-hour exam. Sleep, hydrate, then review every line of code you pasted, every command you typed, and every screenshot you took. The difference between an OSWE and a “failed attempt” is often just 5 hours of careful documentation. OffSec requires clear, readable proofs
scrot -d 5 -e 'mv $f ~/oswe_report/screenshots/app2_$f.png' The “Debugging Output” Secret Weapon OSWE examiners love debugging output. In your exploit script, include print() statements that show the vulnerable function call.
