HTB CWPE study guide
HTB CWPE · Work through your exam, one topic at a time.
The HTB Certified Web Penetration Tester (CWPE) is a practical certification from Hack The Box that assesses whether you can run a realistic web application penetration test end to end, not just recognise vulnerability names in a multiple-choice list. It suits penetration testers, application security engineers, bug bounty hunters and developers moving into offensive security who already understand HTTP, sessions and common web stacks and want an assessment that reflects client work: enumeration, exploitation, chaining and written reporting. The HTB CWPE study guide has 9 sections and about 2,807 words.
01Web Application Reconnaissance and Enumeration
Web Application Reconnaissance and Enumeration on the HTB CWPE exam tests whether you can turn a single URL into a defensible attack-surface map: hosts, routes, parameters, technologies, and hidden API surfaces. The goal is evidence-led discovery before exploitation.
333 words, about 2 min02Authentication and Session Management Attacks
Authentication and Session Management Attacks tests whether you can break identity proofing and session lifecycle controls without confusing authentication with authorization. Expect login, registration, password reset, MFA, remember-me tokens, OAuth/OIDC, and JWT handling.
329 words, about 2 min03Injection Vulnerabilities (SQLi, NoSQLi, Command Injection, SSTI)
Injection Vulnerabilities covers SQLi, NoSQLi, command injection, and SSTI. The exam tests context awareness: where input lands, what parser consumes it, and how to prove impact with the least noise.
322 words, about 2 min04Client-Side Attacks (XSS, CSRF, CORS Misconfiguration)
Client-Side Attacks tests XSS, CSRF, and CORS misconfiguration in realistic browser contexts. The exam cares about execution context, victim interaction, and whether a finding crosses a trust boundary.
308 words, about 2 min05Server-Side Request Forgery (SSRF) and File Inclusion
SSRF and File Inclusion tests whether you can make the server fetch or read resources it should not. Expect URL parsers, allowlists, redirects, cloud metadata, PHP wrappers, log poisoning, and path traversal.
300 words, about 2 min06Insecure Deserialization and Template/Expression Injection
Insecure Deserialization and Template/Expression Injection tests recognition and exploitation of object hydration and server-side expression evaluation. The exam distinguishes data-only serialization from magic-method or gadget-driven execution.
309 words, about 2 min07Access Control Flaws (IDOR, Privilege Escalation, Business Logic)
Access Control Flaws tests IDOR, privilege escalation, and business-logic abuse. The exam focuses on whether the server enforces authorization on every object and action, not whether the UI hides a button.
297 words, about 1 min08API and Modern Web Technology Exploitation
API and Modern Web Technology Exploitation tests REST, GraphQL, WebSockets, and modern auth patterns. The exam expects you to find undocumented endpoints and abuse object-level and function-level authorization.
306 words, about 2 min09Chaining Vulnerabilities and Post-Exploitation
Chaining Vulnerabilities and Post-Exploitation tests whether you can combine low-impact findings into a credible compromise and then operate safely. The exam rewards a clear chain, evidence, and controlled post-exploitation, not a pile of unrelated bugs.
303 words, about 2 min