OffSec CyberCore Certified

0/9 checked

Q_01 domain/d1 · medium single discuss →

You have written a working exploit chain for an OSWE target but it requires the grader to manually paste a token into a second request. According to the exam proof requirements, why will this approach cost you points?

A The PoC script must execute without user interaction and require nothing to be done manually while it runs
B The grader is not permitted to run any PoC scripts at all
C Tokens must always be extracted using a reverse shell, never a script
D You are required to submit a separate script for each vulnerability rather than a single chain

Q_02 domain/d1 · medium single discuss →

An OSWA candidate exploits a web application and obtains the proof.txt value directly through the web UI's administration section rather than through a shell. What evidence must be included in the documentation for this proof?

A A screenshot of the type or cat command output from the file's original location
B Screenshots of Burp Suite (or a web proxy) and the browser showing the web UI on the actual target machine with the proof value visible
C The MD5 hash of the proof value entered into the control panel
D A screenshot proving privilege escalation to root or Administrator was performed