HTB Certified Wi-Fi Pentesting Expert
Preparing the CWPE
Testing the security of wireless networks, from legacy WEP to WPA3 and enterprise networks: rogue access points, Evil Twin, captive portals, credential capture.
Offensive · Wi-FiAdvancedWi-Fi Penetration Tester path
The exam at a glance
Duration7 daysThe countdown never stops
Prerequisite10 modulesWi-Fi Penetration Tester path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowThe shortest path of the list (10 modules), but highly specialised: hands-on practice with wireless hardware and tools matters a lot.
Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.
Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.
Review
Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.
Module tracking
The 10 modules of the Wi-Fi Penetration Tester path, grouped by theme. Tick them off as you go: progress is saved in this browser.
Fundamentals
- Wi-Fi Penetration Testing Basics
- Wi-Fi Penetration Testing Tools and Techniques
Protocols
- Attacking Wi-Fi Protected Setup (WPS)
- Wired Equivalent Privacy (WEP) Attacks
- Attacking WPA/WPA2 Wi-Fi Networks
- Attacking WPA3 Wi-Fi Networks
Attacks on clients and access
- Wi-Fi Evil Twin Attacks
- Bypassing Wi-Fi Captive Portals
- Wi-Fi Password Cracking Techniques
Enterprise
- Attacking Corporate Wi-Fi Networks
What the exam assesses
- Understand 802.11 frames, monitor mode and client association.
- Attack WPS, WEP, WPA/WPA2 (handshake, PMKID) and WPA3.
- Set up an Evil Twin access point and man-in-the-middle attacks.
- Bypass captive portals.
- Attack enterprise networks (WPA-Enterprise / 802.1X) and recover credentials.
- Crack captured secrets efficiently.
Study plan
An example to adapt to your pace. Always alternate modules and practice.
- Wk 1802.11 basics, tools, monitor mode.
- Wk 2–3WPS, WEP, WPA/WPA2, password cracking.
- Wk 4WPA3, Evil Twin, captive portals.
- Wk 5Enterprise networks and a full practice run with a report.
Exam tips
Specific to the CWPE
- In Wireshark, the wlan.fc.type_subtype filter isolates frame types (beacons, authentication, deauthentication).
- Note each network's channel, BSSID and encryption during reconnaissance.
- Plan time for cracking: start it early and keep working in parallel.
Valid for every HTB exam
- Split the time: keep at least a third of it for the report.
- A screenshot at every key step, timestamped notes.
- Stuck for two hours? Note the lead and move on.
- Use the official template or SysReptor's from your practice runs onwards.
Review on this site
Ready to book?
- Wi-Fi Penetration Tester path completed at 100%
- Exam voucher available
- Personal notes organised and easy to search
- Report template ready, already used at least once
- At least one full practice run under real conditions
- 7 days blocked out in the calendar