HTB CWEE

It is a practical lab assessment: you attack a simulated multi-host web environment, then submit a written penetration-test report covering the vulnerabilities you found, the exploitation steps and remediation guidance. There is no separate theory paper. Confirm the current structure and any submission requirements on the official Hack The Box CWEE page before booking.

Those details are set by Hack The Box and change over time, so this page deliberately does not quote them. Check the official CWEE page for the current duration, lab scope, fee and any included retake or report-review terms. Budget your practice around the published figure once you have it.

It sits well above fundamentals-level exams. You are expected to enumerate without hand-holding, recognise chained weaknesses, and exploit them reliably rather than spotting a single reflected XSS. Comfort with Burp Suite, manual HTTP work and reading source code is assumed. Candidates who only know tool defaults usually run out of depth quickly.

Scoring thresholds and retake rules are published by Hack The Box and are not fixed here. Look at the official certification page for the current pass criteria, retake windows and any fees. Read the report rubric carefully - strong exploitation with a weak write-up is a common way to lose marks.

Start with methodical recon and content discovery, then access control and authentication flaws, then injection classes, then client-side and server-side request forgery, and finally API and modern-stack issues. Finish by practising report writing. That order mirrors how real engagements unfold and how findings chain, so later topics build on earlier habits.

Thorough enumeration and note-taking. Most failures come from tunnelling on one suspected bug, missing a second service, or failing to escalate a low-impact finding into a demonstrable compromise. Also common: unreproducible steps in the report, missing evidence, and remediation advice that just says 'sanitise input' without specifics.

Enough that you can enumerate an unfamiliar app and identify its attack surface in under an hour without a checklist. Work retired HTB machines, deliberately vulnerable apps and API labs until chaining bugs feels natural. Quality beats volume: fully documenting twenty boxes teaches more than skimming a hundred.

Burp Suite (including the repeater, intruder and extensions), a proxy-aware browser, ffuf or feroxbuster for content discovery, sqlmap for confirmation rather than blind reliance, and basic scripting in Python or Bash. You should also be able to read JavaScript and server-side source to spot logic flaws tools will miss.

It is a vendor certification issued by Hack The Box, not a government or standards-body accreditation. It is recognised by many employers as evidence of practical skill, but it does not replace experience or other credentials. Verify current recognition and any renewal or validity terms on the official site.

Lead with an executive summary, then per-finding sections: title, severity with justification, affected host and parameter, prerequisites, numbered reproduction steps, request and response evidence, business impact and concrete remediation. Keep it reproducible for a reader who has never seen the lab. Practise this template on practice boxes so it is automatic on exam day.