HTB Certified Web Exploitation Specialist

Preparing the CWES

Finding and exploiting vulnerabilities in web applications in a black-box setting, then documenting them in a professional report. Formerly CBBH (Certified Bug Bounty Hunter).

Offensive · WebIntermediateWeb Penetration Tester path

The exam at a glance

Duration7 daysThe countdown never stops
Prerequisite20 modulesWeb Penetration Tester path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowHTB renamed the CBBH to CWES and the Bug Bounty Hunter path to Web Penetration Tester on 1 October 2025. CBBH holders were migrated automatically.

Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.

Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.

Review

Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.

Module tracking

The 20 modules of the Web Penetration Tester path, grouped by theme. Tick them off as you go: progress is saved in this browser.

Web basics

  • Web Requests
  • Introduction to Web Applications
  • Using Web Proxies
  • Information Gathering - Web Edition
  • Web Fuzzing
  • JavaScript Deobfuscation

Injections and client-side vulnerabilities

  • Cross-Site Scripting (XSS)
  • SQL Injection Fundamentals
  • SQLMap Essentials
  • Command Injections
  • File Upload Attacks
  • Server-side Attacks

Authentication and logic

  • Login Brute Forcing
  • Broken Authentication
  • Web Attacks
  • File Inclusion

APIs, applications and process

  • Attacking GraphQL
  • API Attacks
  • Attacking Common Applications
  • Bug Bounty Hunting Process

What the exam assesses

  • Map an application: subdomains, vhosts, hidden content, parameters.
  • Master a proxy (Burp or ZAP) to intercept, replay and automate.
  • Exploit SQL and command injection, XSS, file inclusion, uploads, SSRF and SSTI.
  • Bypass authentication and access control mechanisms (IDOR, business logic).
  • Test REST and GraphQL APIs.
  • Write every finding reproducibly, with impact and remediation.

Study plan

An example to adapt to your pace. Always alternate modules and practice.

  1. Wk 1–2Basics: HTTP requests, proxies, web information gathering, fuzzing.
  2. Wk 3–5Injections, XSS, uploads, server-side attacks.
  3. Wk 6–7Authentication, access control, file inclusion, APIs and GraphQL.
  4. Wk 8HTB web machines and a full report written under real conditions.

Exam tips

Specific to the CWES

  • Record every interesting request in the proxy: the history is your best evidence.
  • Test each parameter methodically rather than chaining automated tools.
  • A weak finding can become critical when chained with another: look for combinations.

Valid for every HTB exam

  • Split the time: keep at least a third of it for the report.
  • A screenshot at every key step, timestamped notes.
  • Stuck for two hours? Note the lead and move on.
  • Use the official template or SysReptor's from your practice runs onwards.

Review on this site

Methodology

Writing the report

Open →
 Methodology

Web exploitation

Open →
 Cheat sheet

OWASP Top 10

Open →
 Methodology

Reconnaissance and enumeration

Open →
 Cheat sheet

Ports and services

Open →
 Cheat sheet

Reference frameworks

Open →
 Certification

CPTS

Open →

Ready to book?

  • Web Penetration Tester path completed at 100%
  • Exam voucher available
  • Personal notes organised and easy to search
  • Report template ready, already used at least once
  • At least one full practice run under real conditions
  • 7 days blocked out in the calendar