Before typing your first section, review the official OffSec exam guide for strict reporting requirements. Missing even one minor administrative instruction can invalidate your entire submission.
For every vulnerability exploited, provide actionable, secure coding remedies. Avoid generic advice like "fix the code." Instead, offer specific recommendations:
The OSWE exam is a marathon that tests both your technical and your professional skills. The report is your final and only chance to prove your work. The 24-hour reporting period is not the time to relax; it is an active part of the exam. The better your in-exam note-taking and the more organized your approach, the easier the reporting phase will be.
Here is a detailed breakdown of this feature: oswe exam report work
It confirms that you actually understood the vulnerability, not just stumbled upon a flag.
A successful OSWE report follows a rigid, logical layout. Split your document into the following core sections. 1. Executive Summary
A well-designed workflow is your most powerful tool for conquering the OSWE's demanding timeline. You should practice this workflow long before exam day, during your course labs and challenge boxes. Before typing your first section, review the official
Clear instructions that allow a "technically competent reader" to replicate your attacks exactly. Final Exploit Code: The full, non-interactive script used to gain access. Proofs of Exploitation: local.txt / proof.txt: Clear screenshots of the flag files on the target machine. Proof of Remote Access:
To pass, your report must be detailed enough that a technically competent reader can replicate your attacks step-by-step. Methodology Walkthrough
Here’s a structured piece you can use or adapt for your (Advanced Web Attacks and Exploitation). Avoid generic advice like "fix the code
Before you hit "submit" on the OffSec portal, run through this checklist:
) or the archive file can lead to immediate disqualification. Missing Flags : Forgetting to include a screenshot of a flag or the output is a common reason for point deductions. For those preparing, OffSec provides an official Exam Report Template
the exam. They capture every step of their "white-box" discovery—the moment they found a sink in the code, the regex they used to bypass a filter, and the screenshots of their final The Scripting Requirement : The report must include a fully automated exploit script
