Offsec WEB-300 / OSWE Workflow

Reference for structuring a whitebox web application security review from source review through exploit chain PoC and exam-style report.

1. Source Review Workflow

Whitebox review is systematic, not exploratory — follow this order rather than jumping straight to a suspected sink:

1. Entry point mapping — enumerate every externally-reachable route/controller/handler in the application; this is your complete attack surface inventory before you look for bugs
2. Auth/session code paths — trace how authentication and authorization are enforced across those entry points; note any entry point where the check is inconsistent or missing relative to similar routes
3. Data flow / taint tracing — for each entry point, trace user-controlled input from source (request parameter) to sink (DB query, file operation, template render, deserialization call, shell invocation, outbound request)
4. Sink classification — group findings by sink type since remediation and exploitability differ significantly by sink class

Document this as a structured table block per entry point: route, input source, sinks reached, auth requirement, notes.

2. Exploit Chain Documentation

WEB-300 findings are frequently chains (e.g., an authenticated low-privilege bug combined with a logic flaw to reach unauthenticated RCE) rather than single-step bugs. Document chains as: