Skip to content

OSCP 02 - Vulnerability Scanning and Web Attacks

Turning enumeration into a foothold. Web applications are the most common initial access vector in the OSCP lab and exam.

Authorized testing only. This is methodology as taught in PEN-200, for use against the exam environment, your own lab, or systems you have written permission to test.

Vulnerability scanning in the OSCP context

  • Automated scanners - useful for breadth, but the OSCP exam prohibits most automated exploitation tools and restricts automated scanners. Know the exam rules precisely before relying on any tool.
  • Manual confirmation - the exam rewards understanding. A scanner finding is a lead; you must reproduce and exploit it manually.
  • Nmap scripting engine (NSE) - permitted and useful for targeted checks such as SMB vulnerability detection.
  • The mindset - scanners find the obvious. The exam paths are often one manual step beyond what a scanner reports.

Common web vulnerability classes

Injection

  • SQL injection - unsanitized input reaching a database query. Test with a single quote to provoke an error, then determine the number of columns, extract data with UNION-based techniques, or use blind boolean and time-based methods when no output is returned. Can lead to authentication bypass, data extraction, and sometimes command execution or file write.
  • Command injection - input reaching a shell. Chain with ;, |, &&, or backticks. Often the fastest route to code execution when present.
  • Other injection - LDAP, XML (XXE), and template injection appear less often but are worth recognizing.

File handling

  • File upload - uploading a web shell when the application fails to validate type or location. Bypass filters by changing extensions, content type, magic bytes, or using double extensions. The uploaded file must land somewhere executable.
  • Local file inclusion (LFI) - the application includes a file path from user input, allowing you to read arbitrary files, and sometimes to execute code via log poisoning or PHP wrappers.
  • Remote file inclusion (RFI) - including a remote file, rarer but directly leads to code execution.
  • Directory traversal - ../ sequences to read files outside the intended directory.

Authentication and session

  • Authentication bypass - via SQL injection, default credentials, or logic flaws.
  • Weak or default credentials - always tried first. Application defaults and reused passwords are common.
  • Session and cookie manipulation - predictable tokens or values that grant privilege when changed.

Client-side (context on the exam)

  • Cross-site scripting (XSS) - injecting script into pages viewed by others. Important knowledge, but less central to OSCP than server-side flaws because OSCP targets are usually about gaining a shell rather than attacking other users.

From web vulnerability to shell

The recurring objective is a reverse shell: the target connects back to you.

  • Web shell - a script uploaded to the server that executes commands via the browser. The usual first step after a successful upload or LFI.
  • Reverse shell payload - upgrade from a web shell to an interactive reverse shell using a one-liner in the language available on the target (bash, python, php, perl, powershell, or netcat).
  • Listener - a netcat or equivalent listener on your machine to catch the connection.
  • Shell upgrade (TTY) - stabilize a raw shell into a full interactive one, so tab completion, job control, and text editors work. An unstable shell that dies on the first mistake is a major time sink, so upgrade early.

Password attacks in the web context

  • Online brute force - against a login form, mindful of lockouts.
  • Default and common credentials - checked before brute forcing.
  • Credential reuse - passwords found in one place tried everywhere.
  • Hash cracking - offline cracking of hashes found in databases or files, with a wordlist and rules.

Methodology for a web target

  1. Fingerprint the application and its exact version.
  2. Search for known vulnerabilities in that version.
  3. Map all functionality: login, upload, search, parameters, admin areas.
  4. Test each input for injection.
  5. Look for file upload, inclusion, and traversal.
  6. Try default and reused credentials.
  7. Once you have any access, look for the route to a reverse shell.
  8. Stabilize the shell before doing anything else.

Exam pointers

  • Know the exam's tool restrictions cold. Automated exploitation tools are largely prohibited; using a restricted tool can void the attempt.
  • A single quote provoking a database error is the classic first SQL injection test.
  • After any upload or inclusion, the goal is a reverse shell, then a stable TTY.
  • Stabilize your shell immediately; a fragile shell wastes more time than it saves.
  • Reused credentials from a cracked hash are often the pivot to the next host.
  • Confirm scanner findings manually; the exam grades understanding, not tool output.

Official documentation

📖 OffSec PEN-200 syllabus - authoritative content list 📖 OSCP exam guide - allowed tools - the restrictions that matter 📖 OWASP Testing Guide - web vulnerability methodology