OSWA

It is a 24-hour proctored exam. An OffSec employee proctors it, and you work inside a private VPN. There are 5 independent targets, each containing local.txt and proof.txt files. Plan your sleep and note-taking before exam day, because 24 hours is long enough that fatigue decisions matter as much as technical ones.

OffSec states the objective as exploiting the web application to gain an authenticated administrator session and the proof.txt file from the server. That framing matters: a reflected alert box or a blind error message is usually a stepping stone, not the finish line. Read the official exam guide for scoring specifics before booking.

The certification is earned by passing the exam associated with WEB-200, and OffSec sells course access bundles that include exam attempts. The public page does not state a separate eligibility requirement, so check the current exam guide and pricing page for the exact purchase options rather than assuming course purchase is mandatory.

No. OffSec states that, unlike the OSCP+, OSIR and OSTH, the OffSec Web Assessor (OSWA) certification does not expire. That makes it a one-time investment in study time, though you should still keep your practical skills current since web frameworks and defenses change quickly.

OffSec lists no formal prerequisites but strongly recommends basic web development technologies (HTML, CSS, JavaScript), networking fundamentals, and Linux operating system basics. The company points to its Web Application Assessment Essentials Learning Path for those skills. If Burp Suite and the Linux command line are unfamiliar, close that gap first.

Start with reconnaissance and enumeration, because every later attack depends on finding parameters, endpoints and wordlists. Then work through SQLi and XSS, which build payload-testing discipline, followed by CSRF, SSRF, XXE, CORS and SSTI. Finish by revisiting the 9 Challenge labs and reproducing each vulnerability class without walkthroughs.

Typical failure modes are tunnel vision on one target, skipping enumeration because a parameter looks familiar, and stopping at proof-of-concept output instead of chaining to an administrator session. Another is weak reporting and note hygiene during a 24-hour window. Rotate between targets when stuck, and record every request and payload as you go.

OffSec's published bundles differ: the Learn One subscription is described as including two exam attempts, while the Course + Cert Bundle is described as including a single exam attempt. Retake pricing and any separate retake policy are not stated on the pages reviewed, so confirm with OffSec before purchasing.

OffSec points to WEB-300 and the OSWE certification for advanced web attacks and exploitation, alongside its other penetration testing, exploit development, security operations, threat hunting and incident response certifications. Roles listed for OSWA holders include web application penetration tester, application security analyst, DevSecOps engineer and bug bounty hunter.