Advanced Web Attacks and Exploitation (Offensive Security)（Z-Library）

# Advanced Web Attacks and Exploitation (WEB-300) — Reading Guide ## 【One-Line Pitch】 A hands-on offensive security course manual that walks penetration testers through real-world web exploitation techniques—from SQL injection and file upload bypasses to deserialization attacks and XXE—using vulnerable applications as training grounds. Ideal for security professionals preparing for the OSCE3/WEB-300 certification or red-teamers who want structured, lab-driven practice rather than theory. ## 【Book Arc】 - **Opening (~0%–9%)**: Course introduction, lab environment setup, and tooling fundamentals—Burp Suite configuration (proxy, scope, Repeater, Comparer, Decoder) plus source code analysis methods including decompiling .NET and Java classes. - **Early (~9%–25%)**: SQL injection deep-dive—starting with vulnerability discovery, bypassing `addslashes`, improper parameterization, and exploiting PHP loose comparisons; then moving into file upload bypass techniques, gaining remote code execution, and escaping restricted environments. - **Early–Middle (~25%–38%)**: Advanced database exploitation—PostgreSQL extensions, large object reverse shells, and building SQL injection environments; introduces deserialization attacks against .NET (DotNetNuke) with payload construction using ObjectDataProvider and ExpandedWrapper classes. - **Middle (~38%–47%)**: Application-specific exploitation—server-side template injection, MVC framework attacks (Frappe/ERPNext), authentication bypasses, and metadata-driven design pattern abuse. - **Late (~47%–end)**: Password reset vulnerability chains (token prediction, account determination, timing attacks) and XML External Entity (XXE) exploitation—entity processing, CDATA, gaining remote access to HSQLDB, and Java language routines. ## 【Key Takeaways】 - **Burp Suite mastery is the prerequisite skill** (Opening): The course assumes you can configure proxy scope, use Repeater for manual request manipulation, and leverage Comparer/Decoder—these tools appear in every subsequent lab. (Early) - **Source code analysis is a core exploitation skill** (Early): You'll decompile .NET assemblies and Java classes to find vulnerabilities that black-box testing would miss—this is a recurring pattern throughout the course, not a one-off technique. (Early) - **SQL injection is never just about `' OR 1=1`** (Early): The course covers bypassing `addslashes`, improper parameterization, PHP loose comparisons, and MySQL version extraction—showing that real-world SQLi requires understanding the specific language and framework quirks. (Early) - **File upload filters are meant to be broken** (Early): Escaping jails, disclosing web roots, finding writable directories, and bypassing extension filters are presented as a systematic process, not luck. (Early) - **Deserialization attacks require gadget chain thinking** (Middle): The DotNetNuke chapter builds payloads step-by-step—FileSystemUtils, ObjectDataProvider, ExpandedWrapper—demonstrating how to chain .NET classes into arbitrary code execution. (Middle) - **Password reset flows are a rich attack surface** (Late): Token prediction, account determination, and timing reset requests show that "forgot password" features often have exploitable logic flaws beyond simple brute force. (Late) - **XXE is more than file reading** (Late): The course extends XXE to CDATA exfiltration, remote database access (HSQLDB), and Java routine execution—turning a parsing flaw into full remote access. (Late) ## 【Reading Tips】 - **Skim the first 9%** if you already know Burp Suite—the tooling chapters are standard fare; jump straight to the SQL injection and file upload sections where the real learning begins. - **Deep-read the deserialization and XXE chapters** (roughly 25%–47% of the book)—these are the most conceptually dense and where the "advanced" in the title is earned. Expect to re-read the gadget chain constructions. - **Treat every chapter as a lab exercise, not a lecture**: The book is structured around vulnerable applications (ATutor, DotNetNuke, Frappe, etc.). Follow along with your own instance rather than just reading. - **Watch for PHP-specific pitfalls** (loose comparisons, `addslashes` limitations) even if you primarily work in other languages—these appear in multiple labs and are common in real-world targets. - **The final chapters on password resets and XXE** are where the course differentiates itself from beginner material—don't rush through them, as they introduce multi-step attack chains that require careful sequencing. ## 【Coverage Limits】 This guide is based on the table of contents and chapter structure; the excerpts do not cover the actual lab walkthroughs, specific command syntax, or detailed exploit code. The book's blurb about "computer science fundamentals" appears to be a generic publisher description—the actual content is strictly offensive web security. ##