HTB CWPE case studies

The HTB Certified Web Penetration Tester (CWPE) is a practical certification from Hack The Box that assesses whether you can run a realistic web application penetration test end to end, not just recognise vulnerability names in a multiple-choice list. It suits penetration testers, application security engineers, bug bounty hunters and developers moving into offensive security who already understand HTTP, sessions and common web stacks and want an assessment that reflects client work: enumeration, exploitation, chaining and written reporting. The exam is delivered as a hands-on lab in a scenario-based environment, and you submit a report afterwards. The published domains span reconnaissance and enumeration, authentication and session attacks, injection (SQLi, NoSQLi, command injection, SSTI), client-side issues (XSS, CSRF, CORS), SSRF and file inclusion, insecure deserialization and template injection, access control and business logic, API and modern stack exploitation, and chaining with post-exploitation. The HTB CWPE case studies are 5 cases and about 5,800 words.