I85PREP
⌘ K

HTB CWES

HTB Certified Web Exploitation Specialist

More study resources

Cheat sheet

Keep the key ideas within reach.

Explore

Key terms

Get comfortable with the vocabulary.

Explore

Study plan

Give each week a clear focus.

Explore

Common mistakes

Understand the traps and how to avoid them.

Explore

Case studies

Put your knowledge to work in context.

Explore

Exam-day guide

Prepare for the day ahead.

Explore

About this exam

The HTB Certified Web Exploitation Specialist (CWES) is a hands-on certification offered by Hack The Box that validates practical skills in finding and exploiting web vulnerabilities. It is aimed at penetration testers, bug bounty hunters, and security engineers who want to prove they can compromise realistic web applications, not just answer multiple-choice questions. The exam is a live practical assessment: you receive access to target environments, must exploit them to achieve specified objectives, and then submit a professional report documenting your findings and remediation advice. The domains span reconnaissance, injection, client-side attacks, authentication and access control, file inclusion and upload, SSRF and deserialization, framework/CMS exploitation, post-exploitation, and reporting. Because the exam is performance-based, preparation should center on deliberate practice. Work through vulnerable-by-design labs and retired HTB machines that feature web vectors, and get comfortable with tools such as Burp Suite, ffuf, sqlmap, and custom scripts. Build a note-taking and reporting workflow early, since clear write-ups are part of the deliverable. The official Hack The Box site publishes current details on format, scheduling, and any policies, so check there for the latest figures. This page is an independent study resource and is not affiliated with or endorsed by Hack The Box.

What you'll study

Web Application Reconnaissance and Enumeration10% Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)18% Cross-Site Scripting and Client-Side Attacks (XSS, CSRF, DOM clobbering, prototype pollution)15% Authentication, Session, and Access Control Flaws (JWT, OAuth, IDOR, privilege escalation)15% File Inclusion, Upload, and Path Traversal Exploitation12% Server-Side Request Forgery and Deserialization Vulnerabilities12% Web Framework and CMS-Specific Exploitation8% Post-Exploitation, Pivoting, and Web Shell/Command-and-Control Tradecraft5% Professional Reporting and Remediation Guidance5%
Common questions

About HTB CWES preparation

What is the CWES exam format?

It is a hands-on practical assessment. You get access to live target environments and must exploit them to meet objectives, then submit a written report. There are no multiple-choice questions. The official Hack The Box site publishes the current format details.

How difficult is the CWES?

It is intermediate to advanced. You need working knowledge of web vulnerabilities and the ability to chain them under time pressure. Comfort with Burp Suite, manual testing, and scripting is assumed. Prior experience with CTF-style web challenges or real assessments helps.

How long is the exam and how many machines are involved?

Hack The Box publishes the current duration and scope on its official site; these details can change, so confirm there. Plan to manage your time across reconnaissance, exploitation, and reporting rather than treating it as a pure hacking sprint.

What is the passing score and exam fee?

The official body publishes the current passing score and fee. Check the Hack The Box certification page for up-to-date figures. This independent guide does not state them because they are subject to change.

Can I retake the exam if I fail?

Retake policies are set by Hack The Box. Consult the official certification page for the current retake rules, waiting periods, and any associated costs. Do not rely on third-party summaries for policy details.

In what order should I study the domains?

Start with reconnaissance and enumeration, then injection, because these underpin most web attacks. Move to client-side, authentication/access control, and file inclusion/upload. Finish with SSRF/deserialization, framework/CMS specifics, post-exploitation, and reporting. Practice each domain in labs before combining them.

What are common failure modes on the CWES?

Candidates often lose time over-enumerating, miss a simple access control flaw while chasing complex injection, fail to chain vulnerabilities, or neglect the report. Poor note-taking leads to incomplete write-ups. Practice time-boxing and documenting as you go.

How should I prepare for the reporting component?

Treat reporting as a skill. Use a template with summary, affected assets, reproduction steps, evidence, impact, and remediation. Practice writing concise findings from labs. Clear, reproducible steps and business impact matter as much as the exploit itself.

Do I need to know programming languages?

You should be able to read and modify code in JavaScript, PHP, Python, and SQL, and write small scripts for automation. You do not need to be a software engineer, but understanding how applications process input is essential for finding and exploiting flaws.

Is the CWES recognized by employers?

Hands-on certifications are increasingly valued because they demonstrate practical ability. Recognition varies by employer and region. Combine the certification with a public portfolio of labs, write-ups, and bug bounty reports to strengthen your credibility.