CWEE Path Notes — Module 1: Injection Attacks

Wed, 16 Sep 2026 18:45:00 -0400

This kicks off a series where I work through the HTB Certified Web Exploitation Expert (CWEE) path — the Senior Web Penetration Tester job-role path — one module at a time and write down what actually stuck. This is more of “here’s the reasoning and the things that bit me” — the point is the technique, not an answer key.

Module 1 is Injection Attacks, and it covers three of the less-glamorous injection classes that developers rarely defend against precisely because they’re less common: XPath injection, LDAP injection, and HTML injection in PDF generation libraries. That obscurity is the whole opportunity — if an app touches XML, an LDAP directory, or a server-side PDF renderer, it’s often untested ground.

Lfi on Fabrice's Blog

CWEE Path Notes — Module 1: Injection Attacks