> For the complete documentation index, see [llms.txt](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jorgectf.gitbook.io/awae-oswe-preparation-resources/master.md).

# TL;DR

This page does **NOT** pretend to replace [AWAE/OSWE ](https://www.offensive-security.com/awae-oswe/)content, this is a compilation of the best (**public|my own)** **resources** I have come up with.

**AWAE LIST**:

* [Persistent Cross-Site Scripting](/awae-oswe-preparation-resources/by-vulnerability/xss.md#stored) 
* [Session Hijacking](/awae-oswe-preparation-resources/by-vulnerability/xss.md#session-hijaking) 
* [.NET Deserialization](/awae-oswe-preparation-resources/by-vulnerability/deserialization/by-language/.net.md) 
* [Data Exfiltration](/awae-oswe-preparation-resources/by-vulnerability/xss.md#data-exfiltration) 
* [Bypassing File Extension Filters](/awae-oswe-preparation-resources/by-vulnerability/file-upload-restrictions-bypass/file-extension-filters-bypass.md) 
* [Magic Hashes](/awae-oswe-preparation-resources/by-language/php/type-juggling.md) 
* [Bypassing REGEX restrictions](/awae-oswe-preparation-resources/regex.md#filter-bypass) 
* [Cross-Site Request Forgery](/awae-oswe-preparation-resources/general/pocs/csrf.md) 
* [Type Juggling ](/awae-oswe-preparation-resources/by-language/php/type-juggling.md)
* [Blind SQL Injection](/awae-oswe-preparation-resources/general/pocs/sql-injection.md#blind-time-based) 
* [Bypassing File Upload Restrictions](/awae-oswe-preparation-resources/by-vulnerability/file-upload-restrictions-bypass.md) 
* [Loose Comparisons](/awae-oswe-preparation-resources/by-language/php/type-juggling.md) 
* [Bypassing Character Restrictions](/awae-oswe-preparation-resources/by-vulnerability/sql-injection/bypassing-character-restrictions.md) 

**PERSONAL LIST**:

* Blind Time-Based & Boolean SQL Injection + Bypassing Character Restrictions 
  * MySQL 
  * PostgreSQL 
* Deserialization
  * PHP 
  * Java 
  * .NET 
* XSS
  * Reflected 
  * Stored 
  * Data Exfiltration 
  * Filter Bypass 
* Loose Comparison
  * Type Juggling 
    * Magic Hashes 
* REGEX
  * Filter Bypass 
* File Upload Restrictions Bypass 
  * File Extension Filters Bypass 

Great people I have learnt a ton from:\
[@secgus](https://twitter.com/secgus), [@julianjm](https://blog.julianjm.com/), [@cynops](https://twitter.com/cyn0ps), [@devploit](https://twitter.com/devploit), [@oreos](https://twitter.com/oreos_es), [@rmartinsanta](https://twitter.com/rmartinsanta).

Mentioned people:\
[@Takito](https://twitter.com/takito1812), [ITasahobby](https://itasahobby.gitlab.io/).

(**CTF**) Platforms I have enjoyed (and I'm enjoying) **the most**.

{% embed url="<https://websec.fr>" %}

{% embed url="<https://247ctf.com>" %}

{% embed url="<https://portswigger.net/web-security>" %}

{% embed url="<https://hackthebox.eu>" %}