HTB CWEE case studies
HTB CWEE · Put your knowledge to work in context.
The HTB Certified Web Exploitation Expert (CWEE) is a hands-on certification from Hack The Box aimed at penetration testers and application security engineers who already know the OWASP basics and want to prove they can take apart a realistic, multi-service web estate end to end. Rather than a multiple-choice paper, the assessment drops you into a lab network of interconnected hosts - a public-facing application, supporting APIs, internal services and a database tier - and asks you to find, exploit and document the path from an unauthenticated foothold to full compromise. The HTB CWEE case studies are 5 cases and about 2,284 words.
1Boolean-Blind SQLi Behind a Keyword WAF
A regional bookstore runs MySQL 8.0 behind PHP 8.1. The product detail endpoint GET /product?id= concatenates the id parameter unquoted into WHERE id = $id .
477 words, about 2 min2Reset-Code Brute Force With a Trusted X-Forwarded-For
A B2B SaaS support portal uses a 4-digit numeric password-reset code sent by email. POST /api/reset/request accepts JSON {email} and always returns {"status":"sent"} .
503 words, about 3 min3postMessage Origin Suffix Bypass to Account Takeover
A travel booking SPA at booking.example.com is embeddable by partners. It registers a message listener and, for type === 'theme' , assigns data.html to document.getElementById('preview').innerHTML .
381 words, about 2 min4SSRF Filter Bypass in a PDF Invoice Fetcher
A SaaS invoice platform lets users import invoices from a URL. The fetcher service runs in a Kubernetes pod with AWS IMDSv1 enabled at http://169.254.169.254 .
431 words, about 2 min5JWT kid Path Traversal and GraphQL Schema Discovery
A public GraphQL API at https://api.example.com/graphql uses JWT bearer tokens. The middleware reads the kid header, builds path.join('/app/keys', kid) , reads that file, and verifies the token with HS256 using the file contents as the secret.
492 words, about 2 min