Hack The Box - CWES

In February of 2026, I received the Certified Web Exploitation Specialist certification from Hack The Box. It wasn’t long after recovering from the CPTS cert that I began to feel the itch to go after another one. I was impressed by the quality and pricing of my previous learning experience on Hack The Box Academy, so I continued my journey with them. At the time of writing, Hack The Box offer a total of seven certifications to choose from covering everything from the fundamentals of cybersecurity to testing Wi-Fi networks and Active Directory. Having completed CPTS already, I had a solid understanding of the penetration testing process and the various techniques involved, so I was spoiled for choice as to which certification to study.

Why CWES?

I chose to study CWES for a few reasons.

1. In today’s hyper-connected world, every business has their own website to advertise their products and services to potential customers. They may also have web applications floating around to handle things like HR, Payroll, Marketing, Operations, you name it. The web application(s) may even be the revenue generating force for the entire business. It’s very rare to find a business that doesn’t have one or some combination of these. These facts make knowledge of web security vulnerabilities extremely important. We trust web applications with some of our most precious personal data, which makes them a great target for any would-be cyber bad guys. Protecting these applications is super important work and knowledge of their potential security issues is extremely valuable.
2. I’ve been a member of Hack The Box for years and have completed many boxes in that time. Most of them had some kind of web application to exploit before being able to gain a foothold on the machine. This has made web exploitation an essential part of my workflow.
3. Having previously worked as a developer, I’m already quite familiar with web technologies, the various security controls that they offer, as well as methods for getting around or abusing them. The CWES learning path complemented my existing knowledge quite well.
4. The certificate has a really cool looking spider on it.

Do You Need Prior Experience for CWES?

Yes and no. Hack The Box does a very good job of prepping students for the exam. In my opinion, some prior CTF experience (either through Try Hack Me or Hack The Box) would definitely be beneficial, but it isn’t strictly necessary. If you’re a developer or a pentester, you’ll be totally fine. If you’re a complete newbie to cybersecurity, I’d recommend learning some general I.T. and security fundamentals before jumping into CWES. Hack The Box also offer the Certified Junior Cybersecurity Associate certification which is a great option for those that are just starting out in security.

Was It Expensive?

Not at all. As far as certifications go, Hack The Box certs are cheeeeap. If you’re starting right from the beginning, you’re going to be looking at $490 USD (at the time of writing according to the HTB Academy certifications page). Contrast this with the price of other industry certifications on the market and you’ll see that HTB offers great value for money. There are also special discounts available for students so you may be able to get it even cheaper if you qualify.

How Long Did It Take?

My study time for CWES was shorter than CPTS. Not only were there fewer modules to complete, but the overlap between the two courses meant that I had already completed a lot of the modules in the learning path. My study sessions all took place at night and on weekends, so it still took me a few months to get through everything. Everyone learns at their own pace though so your mileage will vary if you decide to go for it yourself.

It’s also important to remember that the cert is a marathon and not a sprint. It’s really tempting to try and move quickly but this ends up costing you later on. The best strategy is always to take things slow and ensure you fully grasp what is going on before moving on to something new.

Would I Recommend CWES?

CWES is an excellent course for both penetration testers and developers alike. Web applications present a large attack surface and are by their nature publicly exposed on the open Internet. Every pentester worth their salt needs to know how to enumerate and exploit web apps as they are frequently used as the initial access vector to an internal network.

On the other side of the fence, developers need to know how to spot web vulnerabilities and stop them from getting to production altogether. When you’re responsible for building the systems tasked with handling our personal data, you absolutely must understand the security consequences of the code you write. Historically, software has been built to work first and be secure second. This is completely backwards. Getting a product to market as quickly as possible is pointless if it leaks user data like water through a sieve. Security is indeed a team effort, but it begins with the software developers. Part of “shifting security left” in the software development lifecycle is educating every dev about the vulnerabilities that can creep into their applications and how to prevent this from happening in the first place. CWES is a fantastic resource for doing just that.

What Did I Learn?

As always, I learned a whole lot of stuff. Hack The Box is incredibly thorough with their learning materials and CWES is no exception. The path goes beyond just teaching the OWASP Top 10 web vulnerabilities. Instead, it teaches everything from the foundational building blocks of web applications to creatively chaining web exploits together to achieve maximum impact.

The course was comprised of 20 modules:

1. Web Requests
2. Introduction to Web Applications
3. Using Web Proxies
4. Information Gathering (Web Edition)
5. Web Fuzzing
6. JavaScript Deobfuscation
7. Cross-Site Scripting (XSS)
8. SQL Injection Fundamentals
9. SQLMap Essentials
10. Command Injections
11. File Upload Attacks
12. Server-Side Attacks
13. Login Brute Forcing
14. Broken Authentication
15. Web Attacks
16. File Inclusion
17. Attacking GraphQL
18. API Attacks
19. Attacking Common Applications
20. Bug Bounty Hunting Process

Each module came with an abundance of reading accompanied with practical exercises to validate the newly acquired knowledge. There were also skills assessments against live targets at the end of each module to link all the new ideas together. I really enjoy this format as it makes the learning process engaging, challenging, and rewarding. All of the modules felt relevant and well placed.

Aside from the technical stuff, there were also a couple of non-technical lessons to be learned.

1. Never Give Up

This is always the hardest thing to remember. Hacking can be a frustrating experience and the desire to give up can creep up on you again and again. It’s normal and everyone feels it. If you find yourself in that position, go and talk to someone. When describing some of my own hacking frustrations to a friend once upon a time, they replied:

The computer never wins, it merely delays its own demise.

There is always a way forward. You just need to persevere long enough to find it.

2. Reporting As You Go

Writing the report as you go is the most underrated advice. It’s easy to get caught up in the hacking flow and lose track of the various issues that you’ve found. You then have to go back and reproduce everything to grab command output and screenshots which takes ages. Make sure you write the report as you go. When you find a vulnerability, make a finding. Write it up and gather all the required evidence before carrying on. Your future self will thank you.

Which Reporting Tool Did I Use?

SysReptor. It is my absolute favourite pentest report writing tool which you can self host for free (or pay to use their cloud version if you’re rich and hate Docker containers). The tool allows you to write your report in markdown, making embedding images and codeblocks so simple. When you’re done, SysReptor will automatically render a beautiful PDF for you. No fiddling with margins or fonts. As a bonus, there are free templates available for all HTB exams! If you haven’t already, I strongly recommend that you install SysReptor and try it out. You’ll wonder how you ever wrote reports without it.

Where Certificate?

Here certificate.

What Next?

As this was my second cert from Hack The Box, I’m thinking of branching out a little. Others have been recommending that I take a look at some OffSec certs like the OSCP or OSWE. I’ve spent a while working on web stuff and am keen to diversify my skillset. There are a few books sitting on my shelf that need reading and I also want to put a bit of time into R&D.

Whichever pursuit I throw myself at next, you’ll hear about it here first.