The OSWE certification is the exam where your Burp Suite muscle memory stops helping you. OffSec hands you source code and two target applications, and expects you to read your way to an authentication bypass and remote code execution inside 47 hours and 45 minutes. Candidates who fail it usually fail for one reason: they prepared like it was a black box pentest.
This is a 12-week plan for the WEB-300 course and the OSWE exam, built around the skill the exam actually tests, which is reading unfamiliar code fast enough to find the bug someone deliberately hid in it.
What the OSWE Exam Actually Involves
OSWE stands for OffSec Web Expert, and it is the certification attached to the WEB-300 course, Advanced Web Attacks and Exploitation. It sits at the 300 level alongside OSEP and OSED, one tier above OSCP.
The exam is remotely proctored and hands-on. You get two target machines running vulnerable web applications written in different languages, plus a debug machine for each with root access and SSH and RDP available, plus a Kali box to work from. On each application you need to bypass authentication and then achieve remote code execution, and you need to write a single-click exploit script that chains both.
| Detail | OSWE (WEB-300) |
|---|---|
| Exam length | 47 hours 45 minutes |
| Reporting window | A further 24 hours to upload documentation |
| Targets | Two web applications, each with a paired debug machine |
| Points available | 100 |
| Points to pass | 85 |
| Format | Open book, remotely proctored, hands-on |
| Expiry | The certification does not expire |
| Course and one exam attempt | $1,749 for 90 days of access |
| Learn One | $2,749 a year, two exam attempts |
| Retake | $249 per additional attempt |
Exam Tip: 85 out of 100 is an unusually high bar. It means partial credit across both machines will not save you. You need one machine fully solved and most of the second, so triaging early and committing to the application you understand better is a scoring decision, not a comfort decision.
What You Are Not Allowed to Use
The exam is open book, and notes and online references are fine. Automated exploitation tools, mass vulnerability scanners, commercial source code analysers, and remote source code mounting are all prohibited. AI chatbots and LLMs with direct prompt access are also excluded.
That last restriction matters for how you revise. If you lean on a model to explain unfamiliar code during preparation, you are training a workflow you cannot use on exam day. Read the code yourself during practice, even when it is slower.
Who Should Sit OSWE, and Who Should Wait
OSWE assumes you can already write code, not just run it. OffSec asks for comfort reading and writing at least one language, the ability to script in Python, Perl, PHP or Bash, familiarity with Linux, and hands-on experience with a web proxy.
Sit it if you can read a 200-line controller in an unfamiliar framework and describe what it does. Wait if you have never written a script longer than a loop, or if your web testing has been scanner-driven.
There is no formal prerequisite, so OSCP is not required. In practice most people arrive from OSCP, and the two exams reward almost opposite habits. OSCP rewards enumeration breadth. OSWE rewards depth on one codebase.
If you are earlier in the pathway and want a structured foundation in penetration testing methodology first, the CompTIA PenTest+ course covers scoping, methodology and reporting before you commit $1,749 to a 300-level exam.
The 12-Week OSWE Study Plan
The plan assumes 10 to 12 hours a week, which fits the 90-day bundle if you start the clock the day the course opens. If you are on Learn One, stretch weeks 1 to 4 and spend the extra time writing code.
Weeks 1 to 2: Build the Reading Habit
Before the course content, fix the bottleneck. Pick two open source web applications in languages you do not use daily, ideally one .NET and one Java or Node.
- Clone each and spend a session mapping the request lifecycle: entry point, router, controller, data layer.
- Find and read the authentication code specifically. Where is the session created, what signs it, what validates it.
- Write a one-page architecture note for each application from memory afterwards.
This is unglamorous and it is the highest-return fortnight in the plan. The exam gives you a codebase you have never seen, and the clock starts immediately.
Weeks 3 to 5: Work the WEB-300 Modules
The course runs to 17 modules and roughly 105 hours of content, covering deserialisation RCE in DotNetNuke, advanced SSRF, persistent XSS, blind SQL injection, session hijacking, type juggling, and manual source code review methodology.
- Do every module exercise. Do not read ahead.
- For each vulnerability class, write down the code pattern that caused it, not just the payload that exploited it. A grep pattern per class is worth more than a payload list.
- Set up your debugger properly now. Remote debugging .NET and Java applications is a skill with a real learning curve, and discovering that at hour four of the exam is fatal.
Weeks 6 to 9: The 20 Challenge Labs
WEB-300 ships with 20 Challenge Labs. These are the closest thing to the exam you will get, and they are the part most candidates rush.
- Target roughly five labs a week.
- Time-box each one to a single sitting where you can. The exam is a stamina problem as much as a technical one.
- Every lab ends with a working single-click exploit script, no exceptions. Not a set of curl commands, not a manual sequence. One script, run it, get a shell.
Exam Tip: Your exploit script is graded material. OffSec expects a script that chains the authentication bypass into RCE and works end to end against a clean target. Practising the exploitation without practising the automation leaves marks on the table.
Week 10: Build the Report Template
You have 24 hours after the exam to upload documentation, and a technically successful exam still fails on a bad report.
- Build a template now with sections for target overview, vulnerability description, proof of concept, exploit code, and step-by-step reproduction with screenshots.
- Redo two Challenge Labs and write the full report for each as though it were graded.
- Time yourself. If a report takes you six hours, you need to know that before the exam, not after.
Week 11: Two Full Dress Rehearsals
Take two Challenge Labs you have not solved and run them back to back under exam conditions: no walkthroughs, no forums, a hard stop at 24 hours each.
Log every time you got stuck and what unstuck you. That log becomes your exam-day triage checklist.
Week 12: Taper and Book
Do not learn new material. Reread your grep patterns, your architecture notes, and your stuck log. Confirm your proctoring setup, your ID, and your environment. Sleep.
How to Spend the 47 Hours
A schedule that works for most people who pass:
- Hours 0 to 2. Enumerate both applications. Get the source, get both debuggers attached, get a rough architecture map of each. Do not exploit anything yet.
- Hours 2 to 4. Decide which application you understand better. Commit to it.
- Hours 4 to 14. Full push on the first application: authentication bypass, then RCE, then the single-click script.
- Hours 14 to 20. Sleep. This is not optional at the 85-point threshold.
- Hours 20 to 38. Second application, same sequence.
- Hours 38 to 44. Screenshots, proofs, and cleaning up both exploit scripts.
- Hours 44 to 47. Verify every proof, verify both scripts run against a reverted target, stop.
The step people skip is reverting the target and rerunning the script at the end. An exploit that only works against a machine you have already poked at is a report finding you cannot substantiate.
OSWE vs OSCP: Which Is Harder?
They are hard in different directions, which is why the question keeps getting asked.
| OSCP | OSWE | |
|---|---|---|
| Core skill | Enumeration and breadth across hosts | Source code review in depth |
| Targets | Multiple machines and an AD set | Two web applications |
| Prep bottleneck | Methodology and note discipline | Reading unfamiliar code |
| Pass threshold | Lower relative to available points | 85 of 100 |
| Tooling | Broad toolkit | Deliberately restricted |
OSCP is broader and less forgiving of poor methodology. OSWE is narrower and less forgiving of weak programming. Developers who move into security often find OSWE the easier of the two, and network-focused testers usually find it much harder.
For a wider view of where these sit against each other, see what to take after OSCP and OSCP vs OSCP+ and what changed.
Frequently Asked Questions
Is OSWE harder than OSCP?
For most candidates, yes, but only because of the coding requirement. OSWE needs 85 of 100 points across two applications you must exploit from source, which leaves very little room for partial credit. If you already write code daily, you may find it more straightforward than OSCP's breadth.
Is OSWE difficult?
It is a 300-level OffSec exam with a 47 hour 45 minute practical and an 85 point pass mark, so yes. The difficulty concentrates in one place: reading unfamiliar source code under time pressure. Candidates who prepare by grinding payloads rather than reading code tend to fail.
Which is harder, OSEP or OSWE?
OSEP is generally rated harder overall because it covers evasion, Active Directory and lateral movement across a larger environment. OSWE is more specialised and more punishing if your programming is weak. Choose on career direction rather than difficulty: OSWE for application security, OSEP for red teaming.
How much does the OSWE certification cost?
The WEB-300 course and one exam attempt is $1,749 for 90 days of access. Learn One is $2,749 a year and includes two attempts, Learn Unlimited is $6,099 a year with unlimited attempts, and an individual retake is $249.
Does the OSWE certification expire?
No. Once you have earned OSWE it does not expire and there is no continuing education requirement, which is one reason it holds value against certifications that need annual renewal.
Ready to Start Practising?
OSWE rewards people who have already built the habit of drilling until recall is automatic, and that habit is worth building on the certifications you sit before it. CertCrush runs realistic practice exams and question banks across the security pathway, from Security+ and CySA+ through to PenTest+ and SecurityX.
Create a free CertCrush account and start practising, or browse the full course catalogue to find the exam you are sitting next.