HTB CWES study guide
HTB CWES · Work through your exam, one topic at a time.
The HTB Certified Web Exploitation Specialist (CWES) is a hands-on certification offered by Hack The Box that validates practical skills in finding and exploiting web vulnerabilities. It is aimed at penetration testers, bug bounty hunters, and security engineers who want to prove they can compromise realistic web applications, not just answer multiple-choice questions. The HTB CWES study guide has 9 sections and about 2,333 words.
01Web Application Reconnaissance and Enumeration
Web application reconnaissance on CWES is scoped to discovering the real attack surface before exploitation: hostnames, virtual hosts, content, parameters, APIs, and technology versions. You are expected to move from passive collection to active enumeration without crossing scope.
298 words, about 1 min02Injection Vulnerabilities (SQLi, Command Injection, SSTI, LDAP/XPath)
CWES groups SQL injection, OS command injection, SSTI, and LDAP/XPath injection because the first task is always to identify the interpreter and the syntactic context. SQLi: test quote/comment behavior, then UNION with matching column count, error-based, boolean, time-based, and second-order.
295 words, about 1 min03Cross-Site Scripting and Client-Side Attacks (XSS, CSRF, DOM Clobbering, Prototype Pollution)
XSS must be proven in the exact context: HTML body, attribute value, JavaScript string, URL, or CSS. Reflected, stored, and DOM-based variants differ in source and sink.
288 words, about 1 min04Authentication, Session, and Access Control Flaws (JWT, OAuth, IDOR, Privilege Escalation)
CWES tests JWT handling, OAuth flows, session management, IDOR, and privilege escalation as one access-control domain. JWT: decode header/payload, test alg:none , weak HS256 secrets, kid path traversal/SQLi, jku / x5u SSRF, and RS256-to-HS256 confusion using the public key.
269 words, about 1 min05File Inclusion, Upload, and Path Traversal Exploitation
File inclusion tests whether user input reaches include , require , or template loaders. LFI: use php://filter/convert.base64-encode/resource=index.php to read source, php://input or data:// when allow url include is on, log poisoning, /proc/self/environ , and session files.
251 words, about 1 min06Server-Side Request Forgery and Deserialization Vulnerabilities
SSRF occurs when the server fetches a user-controlled URL. Test allowlist parsing with decimal/octal IPs, IPv6, DNS rebinding, redirects, and URL schemes ( gopher:// , file:// , dict:// ).
231 words, about 1 min07Web Framework and CMS-Specific Exploitation
CWES expects version-aware exploitation. WordPress: enumerate users, plugins, themes, xmlrpc.php , and wp-config.php backups; use wpscan and check plugin CVEs.
233 words, about 1 min08Post-Exploitation, Pivoting, and Web Shell/Command-and-Control Tradecraft
After RCE, stabilize the shell (PTY upgrade), enumerate the host, and collect credentials, keys, configs, database access, and cloud metadata. Linux: sudo -l , SUID, cron, capabilities.
236 words, about 1 min09Professional Reporting and Remediation Guidance
A CWES report must be reproducible and actionable: executive summary, scope, methodology, findings with CVSS, request/response evidence, impact, remediation, and references. Severity must reflect exploitability and business impact, not payload cleverness.
232 words, about 1 min