Skip to content
CertGPS

OffSec Web Expert

Proves you can find chained web vulnerabilities by reading source code, then automate the full attack in one unattended script within 48 hours

ExpertOffSec

The exam

Exam cost
$1,749
Study time
4-8 months
Passing score
85 of 100 points
Valid for
Lifetime

Before you book

  • None required
  • Recommended: reading and writing at least one programming language
  • Recommended: Linux, simple Python, Perl, PHP or Bash scripting, and web proxy experience

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

    • Web App Penetration Tester
    • Application Security Analyst

  2. Mid level

  3. Senior level

Where it leads

  1. OffSec Certified Professional

    Advanced

    Comes before. Not required, but its enumeration and reporting habits carry straight into OSWE

  2. OffSec Web Expert

    You are here

Study guide

Last updated

OSWE Study Guide: WEB-300, the 48-Hour Code Review Exam and Its Script Rule

The OffSec Web Expert (OSWE) is a code-review credential. You get 47 hours and 45 minutes inside a small network of web applications, and you find your way in by reading how they're built. Unlike most web exams, it also asks for one script per target that runs the whole attack without anyone touching the keyboard. The credential doesn't expire, and it's one of the three exams behind OffSec's OSCE³.

Who OSWE is for, and who should start elsewhere

OSWE suits web application testers who already read source code during engagements, application security engineers who review pull requests for flaws, and developers moving into security who want proof they can find bugs in code rather than in a scanner report. OffSec sets no formal prerequisite. It recommends being able to read and write at least one programming language, working comfortably in Linux, writing simple Python, Perl, PHP or Bash scripts, and having used a web proxy.

Take the list literally: if following user input through a controller, a data access layer and a template still takes you an afternoon, build that skill on a black-box exam first: eWPT or GWAPT both test web attacks without asking for code review. OSCP isn't required, but its habits of enumerating patiently and documenting as you go carry straight over. If your job is to defend applications rather than test them, GWEB or CSSLP fits better.

The OSWE exam at a glance

OSWE exam
FormatProctored practical: several vulnerable web applications in a private VPN, reached from Kali Linux over OpenVPN
Time47 hours 45 minutes, then 24 hours to upload the report
Passing score85 of 100 points; partial credit is possible
ProofFlags for each machine, plus one exploit script per machine that runs without interaction
Price$1,749 Course + Cert Bundle (90 days, one attempt); $2,749 a year for Learn One (two attempts)
PrerequisitesNone; programming, Linux, scripting and web proxy experience recommended
ResultsWithin 10 business days of submitting the report
ValidityDoesn't expire

What the exam actually rewards

The script rule decides how you spend the 48 hours. OffSec's exam guide says the grader runs your proof-of-concept and shouldn't have to do anything while it runs. You may start a listener or a web server beforehand, and if the script lands you a shell you can collect the flags by hand. Otherwise it has to pull them out on its own. A chain that works once in Burp Suite isn't finished until it's reliable code, so plan for the scripting to take hours, not minutes. The script's source also goes into the report.

The restrictions shape the review itself. Source code analyzers, automatic exploitation tools such as SQLmap, mass vulnerability scanners and AI chatbots, OffSec's own KAI included, are all banned. You can't download application code from the exam environment to your own machine or mount it remotely. That leaves you reading code with your own eyes on OffSec's machines. Nmap, Nikto, the free edition of Burp, DirBuster and payload generators such as ysoserial are allowed. You get 50 machine reverts, and the counter can be reset once.

WEB-300, Advanced Web Attacks and Exploitation, is the course behind the exam. OffSec describes 17 modules built around case studies of real applications, and the syllabus covers code review with static and dynamic analysis, authentication bypass, session hijacking, blind SQL injection, persistent cross-site scripting, server-side request forgery and deserialization flaws, including in .NET applications. No domain weights are published. The exam guide expects each machine's script to exploit several vulnerabilities in sequence, so most of your practice should go into chaining them.

A WEB-300 plan that ends in working scripts

Treat each case study as two jobs. Work through the module with the course text open, then put it away a few days later and rebuild the whole chain from a fresh revert as a single script, which is the part the exam actually grades. Write those scripts in one language, the one you'll use on exam day, and keep them in a personal library: the session handling, the request helpers and the parsing code will be the same next time.

Learn the debugging setup for each technology stack in the course early on. Dynamic analysis, stepping through an application while it handles your request, is how WEB-300 teaches you to confirm what you think the code does, and it's slow the first few times. Keep notes by vulnerability class rather than by module. For each one, note where the flaw tends to live in the code, what input reaches it, and what the patched version looks like. When you're scanning thousands of lines on exam day, that's the index you'll want.

As a rough split, we'd give about half of your time to the modules, a third to rebuilding chains without the guide, and the rest to two full rehearsals. For each rehearsal, pick applications from the course labs, set a 48-hour clock, and finish with scripts and a report in OffSec's Word or LibreOffice template. The 90-day bundle is tight for that unless you can study most days. Learn One's year of access and second attempt cost $1,000 more, and for most people with a full-time job that's the safer purchase.

On exam day, sleep is part of the plan. The 47 hours 45 minutes run from your start time to 15 minutes short of the same time two days later, so decide where the two nights go before you begin.

Retakes, renewal and what to earn next

A failed attempt starts a cooling-off period before you can book again; OffSec's retake policy sets the length. OSWE never expires and has no maintenance fee of its own. Passing it also renews an OSCP+ if you hold one and keep paying OffSec's annual fee. If you fall short, OffSec emails the score and offers feedback on request.

Three next steps:

  • OSEP for evasion and Active Directory attacks; with OSWE and OSED it completes OSCE³.
  • OSED if the deserialization modules made you curious about memory corruption and Windows internals.
  • CSSLP if your career is heading toward running a secure development program rather than testing it.

Our view

OSWE is the best-known credential that tests code review under exam conditions, and the script requirement matches what a good finding needs in practice: something a developer can run again and watch fail. That makes it more credible to application security teams than a multiple-choice web exam. Against that, the 48-hour format tests stamina along with skill, $1,749 for 90 days is a lot for a specialist credential, and generalist recruiters are more likely to have heard of OSCP. Buy it for the skill and for application security roles. Don't buy it to get past a résumé filter.

Sources