[+] Sending payload to index.php?page=../../../../etc/passwd%00 [+] Server response includes 'root:x:0:0:...' -> LFI confirmed. [+] Now reading /var/www/secret.php for API key... This proves you understand the mechanism , not just the result. Vulnerability Title: Unauthenticated Remote Code Execution via assert() Injection in core/logic.class.php
Example Python output to include in report: oswe exam report
Use Shift+Ctrl+PrtScn (Windows) or Shift+Cmd+4 (Mac). Paste into the document at full size. Advanced Tips for the OSWE Exam Report Use a Template (But Customize It) Offensive Security does not provide a mandatory template for OSWE (like they do for OSCP). However, you should build one in Markdown (converted to PDF) or Microsoft Word with styles. [+] Sending payload to index
public function runCommand($user_input) { $result = ""; assert("$result = $user_input"); return $result; } The runCommand() method takes user-controlled input from the cmd POST parameter. The assert() function evaluates the string as PHP code. Since no sanitization is applied, an attacker can break out of the string concatenation by injecting '.phpinfo().' , leading to arbitrary code execution. However, you should build one in Markdown (converted
Treat the report as a separate, 24-hour exam. Sleep, hydrate, then review every line of code you pasted, every command you typed, and every screenshot you took. The difference between an OSWE and a “failed attempt” is often just 5 hours of careful documentation.
Your goal is to provide a document that allows Offensive Security’s lab team to verify your findings.