HTB CWEE study guide
HTB CWEE · Work through your exam, one topic at a time.
The HTB Certified Web Exploitation Expert (CWEE) is a hands-on certification from Hack The Box aimed at penetration testers and application security engineers who already know the OWASP basics and want to prove they can take apart a realistic, multi-service web estate end to end. Rather than a multiple-choice paper, the assessment drops you into a lab network of interconnected hosts - a public-facing application, supporting APIs, internal services and a database tier - and asks you to find, exploit and document the path from an unauthenticated foothold to full compromise. The HTB CWEE study guide has 8 sections and about 2,174 words.
01Web Application Reconnaissance and Enumeration
Web Application Reconnaissance and Enumeration is where CWEE expects you to map an application before touching exploit logic. The exam tests whether you can turn scattered HTTP responses, JavaScript, and DNS data into an attack surface you can explain.
278 words, about 1 min02Authentication and Authorization Flaws
Authentication and Authorization Flaws covers broken access control, IDOR, and session handling. CWEE tests whether you can prove that an identity can reach data or actions outside its intended boundary, and whether session design creates a bypass.
291 words, about 1 min03Injection Vulnerabilities
Injection Vulnerabilities spans SQLi, NoSQLi, command injection, SSTI, and LDAP/XPath injection. CWEE tests whether you can identify the interpreter behind an input, choose a payload appropriate to that context, and demonstrate controlled impact.
278 words, about 1 min04Client-Side Attacks
Client-Side Attacks covers XSS, CSRF, prototype pollution, and DOM clobbering. CWEE tests whether you can trace data from a controllable source to a dangerous sink, then show a realistic consequence such as session abuse, account takeover, or privilege escalation.
278 words, about 1 min05Server-Side Request Forgery and File Handling
Server-Side Request Forgery and File Handling covers SSRF, upload flaws, LFI/RFI, path traversal, and deserialization. CWEE tests whether you can turn a server-side primitive into data access, code execution, or cloud credential exposure.
259 words, about 1 min06Modern Web Stack and API Exploitation
Modern Web Stack and API Exploitation covers JWT, OAuth, GraphQL, WebSockets, and cloud-integrated services. CWEE tests whether you understand protocol-specific trust boundaries and can exploit them without relying on generic web payloads.
257 words, about 1 min07Chaining Exploits into Full Compromise and Post-Exploitation Pivoting
Chaining Exploits into Full Compromise and Post-Exploitation Pivoting tests whether you can combine low-severity findings into a credible path to sensitive access. CWEE values a documented chain with clear prerequisites over isolated payloads.
270 words, about 1 min08Reporting, Remediation Guidance, and Professional Communication
Reporting, Remediation Guidance, and Professional Communication tests whether you can turn technical work into a clear, actionable document. CWEE expects findings that a developer can reproduce and a manager can prioritize without reading raw payloads first.
263 words, about 1 min