Breaking the Web Stack — OWASP-BWA (Pentest Range Module M4)

Breaking the Web Stack: OWASP-BWA (Module M4)

Pentest Range series · Part 4 of 5 · by Vinh NTT

More breaches start at the application layer than anywhere else, and the skills are different from network exploitation — you're reasoning about how the app trusts input, not which CVE the OS is missing. Module M4 of the CertInstructor Pentest Range points you at OWASP Broken Web Applications (OWASP-BWA) at 10.10.10.31 and walks ten labs that mirror the OWASP Top 10.

Simulation only. Every request and payload in M4 is simulated in your browser. No real application is attacked.

The M4 kill chain — ten labs

Notice the module tells a story: you discover the apps, break in via SSTI, make your foothold durable with a web shell, steal cloud credentials and user data, hijack a session, turn the shell into C2, exfiltrate the loot, and finally deface the site — then you go hunting for every step you just took.

Step by step: discovery → first foothold

1. From the portal, enter the Web platform (M4) and open Stage 01 · Web Discovery.
2. Map the attack surface. Brute-force directories, files and virtual hosts to find what's actually running — login pages, an upload.php, a proxy.php, a documents.php. You can't attack what you haven't found; this is the web equivalent of Nmap. Finish the missions.
3. Open Stage 02 · SSTI → RCE. Find the input that gets evaluated by the template engine and confirm it with the classic probe: does {{7*7}} come back as 49? If it does, the server is running your input as code. Escalate that into full remote code execution and take your foothold. The quiz ties it back to OWASP A03 (Injection) and how proper sandboxing/escaping prevents it.
4. Open Stage 03 · Web Shell. Turn that foothold into persistence — upload a disguised PHP file into the webroot so you have durable, credential-free command execution any time you want it. This shell is the thread that the C2 and exfiltration labs later pull on.

From here each lab hands off to the next exactly like a real web engagement.

Working the rest of the module

• SSRF is the cloud-era lab: abuse proxy.php?url= to make the server itself request 169.254.169.254 (the cloud metadata endpoint) and hand you the instance role's temporary IAM credentials. This is how a single SSRF becomes a cloud-account compromise.
• IDOR is the "no exploit, just a number" lesson: increment documents.php?doc_id= and read records that were never yours, then harvest the whole repository. Broken access control is boring to look at and devastating in practice.
• XSS → Session Theft moves the attack into the victim's browser: inject JavaScript via a reflected parameter to steal a session cookie and ride the user's authenticated session.
• Web Shell C2 → Exfiltration → Defacement is the endgame: use your shell as a two-way command channel, stage and exfiltrate the data you harvested, and finally overwrite the index page — the visible impact that turns an invisible breach into a headline.
• Blue Team closes M4 from the defender's chair, but with web telemetry this time — access logs, WAF alerts, application logs — not Windows Event IDs.

Where M4 fits in your certification path

M4 is the application-security half of offensive work, so it maps to PenTest+'s web and injection domains — and the cloud/SSRF and IAM-credential labs push into the enterprise, cloud-aware thinking that SecurityX (CASP+) is built for.

Next step when you're ready:

• CompTIA PenTest+ CertMaster Labs (PT0-003 V3) — hands-on web and network exploitation on official lab environments.
• CertMaster Labs for CompTIA SecurityX (CAS-005) — for the cloud, IAM and enterprise-architecture depth these labs start to touch.

Up next

You've attacked Linux, Windows and the web. Now put the badge away and pick up the one every one of those attacks was quietly generating: evidence. The capstone is the defender's turn.

→ Continue to Module M5 — The SOC Blue Team Capstone

About the author — Vinh NTT  , founder of CertInstructor, 20+ years in IT-security training. Full CompTIA security stack (Security+, CySA+, PenTest+, SecurityX); two-time EC-Council Instructor Circle of Excellence Award winner (2022 & 2023). The Pentest Range is his original work, shared free.