HTB Certified Web Exploitation Expert
Preparing the CWEE
High-level web exploitation: white-box code review, advanced vulnerabilities and chains leading to code execution. The natural follow-up to the CWES.
Offensive · Advanced webAdvancedSenior Web Penetration Tester path
The exam at a glance
Duration10 daysThe countdown never stops
Prerequisite15 modulesSenior Web Penetration Tester path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowSpecific rule: the report is submitted as raw Markdown (.md) files in a ZIP archive protected by the password given in the exam instructions.
Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.
Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.
Review
Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.
Module tracking
The 15 modules of the Senior Web Penetration Tester path, grouped by theme. Tick them off as you go: progress is saved in this browser.
Advanced injections
- Injection Attacks
- Introduction to NoSQL Injection
- Blind SQL Injection
- Advanced SQL Injections
Authentication and client side
- Attacking Authentication Mechanisms
- Advanced XSS and CSRF Exploitation
HTTP protocol
- HTTPs/TLS Attacks
- Abusing HTTP Misconfigurations
- HTTP Attacks
White-box and modern techniques
- Intro to Whitebox Pentesting
- Modern Web Exploitation Techniques
- Whitebox Attacks
- Parameter Logic Bugs
Deserialization
- Introduction to Deserialization Attacks
- Advanced Deserialization Attacks
What the exam assesses
- Read source code to find vulnerabilities no scanner can see.
- Exploit blind SQL injection, NoSQL and rarer injections.
- Abuse the HTTP protocol: request desynchronisation, cache poisoning, misconfigurations.
- Exploit deserialization and parameter logic flaws.
- Bypass robust authentication and chain XSS with CSRF.
- Chain several flaws up to remote code execution.
Study plan
An example to adapt to your pace. Always alternate modules and practice.
- PrerequisiteBe comfortable with the CWES syllabus before starting.
- Wk 1–3Advanced injections and authentication.
- Wk 4–6HTTP and TLS attacks, modern techniques.
- Wk 7–9White-box and deserialization: read a lot of code.
- Wk 10Practise writing in Markdown, in the expected format.
Exam tips
Specific to the CWEE
- In white-box work, start from the entry points (routes, controllers) and follow the data to dangerous functions.
- Prepare a Markdown template in advance: the submission format is imposed.
- Keep a local environment to reproduce the application and test safely.
Valid for every HTB exam
- Split the time: keep at least a third of it for the report.
- A screenshot at every key step, timestamped notes.
- Stuck for two hours? Note the lead and move on.
- Use the official template or SysReptor's from your practice runs onwards.
Review on this site
Ready to book?
- Senior Web Penetration Tester path completed at 100%
- Exam voucher available
- Personal notes organised and easy to search
- Report template ready, already used at least once
- At least one full practice run under real conditions
- 10 days blocked out in the calendar