Upon reviewing upload.php , it was observed that the application relies on a client-side check for file extensions. The server-side logic fails to enforce a whitelist.
You must copy the of these files into your report. Not a screenshot of the hash (though include that too)—the actual string. Offensive Security validates these via automated checks.
Write step-by-step instructions for a human to follow manually (without the script).
The exam report is a professional penetration testing document that serves as the final deliverable for the WEB-300 certification. It must detail every step taken to identify and exploit vulnerabilities during the 48-hour exam period. Core Report Requirements
The OSWE exam report is the final gatekeeper to your certification. By focusing on , step-by-step reproducibility , and clean automation , you demonstrate that you aren't just a "script kiddie," but a professional web security expert.
No input sanitisation. $id concatenated directly into query.
Example: