Use the official OffSec template. Populate the technical sections first while the memory of the exam is fresh. Save the Executive Summary for last, as it is easier to summarize findings once the technical details are mapped out. Step 5: Review and Compile

The OSWE exam typically rewards two flags:

public function runCommand($user_input) $result = ""; assert("$result = $user_input"); return $result;

This is the core of your document. You must document each target machine in its own dedicated section. Vulnerability Identification (Code Analysis)

The file name matches your OSID exactly (e.g., OS-XXXXX-OSWE-Exam-Report.pdf ). All code blocks contain full, un-truncated scripts.

Repeat for each distinct vulnerability (e.g., File Upload Bypass, Command Injection, Auth Bypass).

In this guide, we will dissect exactly what the OSWE exam report requires, how to structure it for maximum points, and common pitfalls that lead to an “Incomplete” or “Fail” status.