HTB CWPE exam-day guide
HTB CWPE · Prepare for the day ahead.
Your checklist
Valid government-issued photo ID
Bring the same ID type and name spelling you registered with. Confirm with the provider which document types are accepted and whether the name must match your account exactly; mismatches are a common cause of last-minute admission problems.
Working webcam and microphone
The CWPE is a practical, proctored exam delivered remotely. Test your camera, mic, and speakers in advance and confirm with the provider what hardware and browser are supported. Have a backup headset or external mic ready.
Stable internet connection with a fallback
Wired ethernet is preferable to Wi-Fi. Have a phone hotspot or second connection available in case your primary link drops mid-exam. Confirm with the provider how a disconnection is handled and whether you must report it immediately.
Clean, private room and desk
Proctored practical exams typically require a quiet room with no other people, no second screens unless permitted, and a clear desk. Remove notes, phones, and anything that could be read as unauthorized material. Confirm the provider's room requirements.
VPN client and your attack environment pre-installed and tested
The exam gives you access to a lab network through a VPN. Install and test the client the day before, verify you can connect, and know how to reconnect quickly. Confirm with the provider which VPN and connection details are supplied on exam day.
Core tooling installed and verified
Have your usual toolset ready: a proxy such as Burp Suite or ZAP, an interception CA certificate configured, a scripting runtime (Python), a browser with developer tools, and any editors or note-taking apps you rely on. Verify they launch and work offline so a slow connection does not block you.
Your own methodology notes and payload references
Confirm with the provider whether open-book use of your own notes and documentation is allowed. If it is, prepare concise checklists for web exploitation, authentication and session flaws, access control testing, and report writing. Keep them in a single searchable document.
Report template prepared
The CWPE is a penetration-testing style exam, so a clear report is part of the deliverable. Pre-build a template with sections for findings, reproduction steps, evidence, impact, and remediation. Confirm the required report format, file type, and submission method with the provider.
Time-tracking plan and target list
Write down the number of targets or flags and a rough time budget per target before you start. This prevents sinking hours into one host. Confirm the exact number of objectives and the pass threshold with the provider, since these are not assumed here.
Backup power and a charged phone
Keep your laptop plugged in, have a charged phone for the proctor or support line, and know the provider's support contact. A power cut with an uncharged battery is an avoidable failure.
Confirm exam scheduling and start window
needs_review: Verify your booked slot, time zone, and how early you may launch the exam. Confirm with the provider whether the clock starts at your scheduled time or when you first log in.
Review the provider's exam rules and acceptable-use policy
needs_review: Read the current candidate handbook for rules on open-book material, automation, sharing, and reporting. Policies change, so confirm directly with the provider rather than relying on forum posts.
Plan the day
Stop learning new topics and consolidate. Re-read your methodology notes on the vulnerability classes most likely to appear in a web-focused practical: injection, broken authentication and session management, access control, server-side request forgery, file upload and path traversal, and business logic flaws. Do two or three timed practice boxes end to end, including writing a short report, so the reporting step is muscle memory. Test your VPN and tooling against a lab target. Draft and save your report template.
Do a full technical rehearsal: connect the VPN, launch your proxy, intercept a request, run a script, and confirm your browser trusts the proxy CA. Check camera, mic, and internet, and run any proctor system check the provider offers. Prepare your desk and room. Confirm your start time and time zone. Get a full night of sleep rather than cramming; fatigue costs more points than one extra payload list gains.
Eat properly and hydrate. Re-run the quick checks: VPN connects, proxy works, notes open, report template ready, phone charged, room clear. Log in early to handle identity verification and any proctor setup. Close unnecessary applications and silence notifications. Have water and a snack within reach if the rules allow it.
Read the full scope and rules before touching a target. Enumerate the targets and write your time budget. Confirm the flag or objective format and how to submit. Set up a notes file with one section per target. Do not start exploiting until you know how many objectives exist and roughly how long you can spend on each.
Work methodically: enumerate broadly, then go deep. Keep a running log of every command, request, and finding with timestamps, because evidence is needed for the report. If you are stuck on one target for longer than your budget, move on and return later. Take short breaks to stay sharp. Submit or record each objective as soon as you confirm it rather than saving everything for the end.
Stop starting new exploitation chains. Consolidate evidence, finish the report, verify every finding has reproduction steps and impact, and confirm the submission method and deadline. Submit before the wire, not at it, in case of upload or connection problems.
Rules to check
Follow the provider's acceptable-use and scope rules exactly. Only touch systems explicitly in scope, and confirm with the provider what is permitted regarding automated scanning, brute force, and denial-of-service-style testing before you begin.
Keep your identity verification consistent: use the same legal name and ID you registered with. Confirm with the provider what happens if your documents do not match your account.
Treat the environment as proctored. Do not communicate with other people about the exam content during or after the test, do not share flags or answers, and do not post write-ups until the provider's embargo, if any, has passed. Confirm the current confidentiality terms with the provider.
Confirm break policy with the provider before exam day. Many proctored practical exams allow short breaks but may pause or not pause the clock, and may require you to stay on camera; do not assume either way.
Confirm the scoring model with the provider: how objectives or flags map to points, the passing threshold, and whether partial credit exists. Do not rely on secondhand figures.
Confirm what reference material is allowed. If open-book notes are permitted, keep them local and static; do not use search engines, AI assistants, or communication tools unless the provider explicitly allows them.
Report any technical failure or rule ambiguity to the provider or proctor immediately and document it. Do not attempt to work around a broken lab system on your own.
Submit the report and any required deliverables in the format and by the deadline the provider specifies. Late or malformed submissions may not be graded, so confirm the requirements in advance.