OSWE

It is a hands-on practical assessment, not a multiple-choice test. You work against live targets with access to their source code, develop working exploits, and submit a written report. Scoring depends on the report demonstrating reproducible exploitation, so clear documentation of each step matters as much as getting the exploit to run.

Those figures are set by the certifying body and change over time, so check the official OffSec website for the current duration, price, and scheduling options rather than relying on second-hand numbers.

OffSec publishes the current passing threshold and scoring breakdown on its site. Because points are awarded for documented, working exploitation rather than partial credit for guesses, plan to fully compromise the required objectives and write each one up clearly.

It is generally considered demanding because it removes tooling crutches: you must read source, understand framework routing and data flow, and write exploits yourself. Candidates with real code review experience and scripting fluency tend to find it manageable; those who only know scanner-driven testing usually struggle.

Retake policies, waiting periods, and any associated fees are defined by OffSec and are subject to change. Consult the official site for the current retake rules before booking, and factor a possible second attempt into your study plan.

Start with source code review and tracing user input to sinks, since everything else depends on it. Then move through authentication and access control, injection classes, file handling, deserialization and template injection, SSRF and XXE, and finally business logic. Practise chaining at the end, once individual primitives are solid.

A common failure mode is getting a shell but writing vague steps that a grader cannot reproduce. Capture every request, payload, and script, explain why each flaw exists in the code, and show the exact sequence of the chain. Assume the reader has the same source but none of your context.

Yes, practically speaking. The exam rewards scripting exploits in Python or similar so that steps like blind injection extraction or token forgery are reliable and repeatable. Practise turning manual requests into short scripts during preparation, including handling sessions, CSRF tokens, and non-standard encodings.

Read open-source web applications in languages you know, pick a parameter, and follow it through routing, validation, and database or filesystem calls. Set time-boxed labs where you must go from source to working exploit without a scanner, then write a short report for each. That loop mirrors the exam.