CWEE: HTB Certified Web Exploitation Expert

What CWEE is and who runs it

The HTB Certified Web Exploitation Expert (CWEE) is run by Hack The Box and taken through HTB Academy, its training platform. It sits at the expert end of HTB’s web track, above the Certified Web Exploitation Specialist (CWES, formerly CBBH). The focus is white-box web exploitation: you read application source code, work out where the logic breaks, and write working exploits plus remediation patches. Black-box testing features too, but source-code review and exploit development are the heart of it. This is not a foundational cert; HTB positions it for people already fluent in web attacks and comfortable writing code.

Cost and what’s included

There are two official routes. A standalone CWEE exam voucher costs $350 (HTB lists $416.50 including VAT). Alternatively, the Gold Annual HTB Academy subscription is $1,260/year and includes one CWEE exam voucher plus full access to the modules and job-role path you need to prepare. CWEE is bundled only in the Gold tier, not Silver. The voucher itself includes two attempts, so a failed first sitting doesn’t automatically cost another purchase. Whichever route you pick, you’re paying for both the training content and the exam — HTB’s model across Academy.

Time: the exam and the report

The exam lab is available for ten days without restrictions, and your report is due inside that same 10-day window. You submit it as Markdown files zipped and password-protected, up to 20MB. The report is not a formality: you document the vulnerabilities you found, the exploits you built, and remediation for each. HTB grades manually, so results are not instant. If you submitted a report and failed, you receive feedback and 14 days to start a second attempt, which again runs for ten days.

How hard it is, honestly

CWEE is genuinely difficult and widely described as one of HTB’s hardest web certifications. Candidates report chaining several vulnerabilities per target across multiple, heterogeneous applications, working from source code rather than guessing from the outside. Reviewers note the exam requires creative thinking, while adding that the course materials are enough to pass. The consistent message: you need real programming ability and patience, but the training genuinely prepares you if you finish it.

Is it worth it — and for whom

CWEE makes sense for people specialising in web application security: penetration testers, bug bounty hunters, and application security engineers who want to prove white-box, code-level skill. It is not a first cert and not a résumé filler for beginners. Compared with OSWE, reviewers who hold both tend to rate CWEE’s exam realistic and its training deep. If you don’t write code, or don’t work in web security, your money is better spent elsewhere first.

How to prepare

Complete the Senior Web Penetration Tester job-role path to 100% — HTB requires full completion before you can sit the exam. Recommended background is the Bug Bounty Hunter path or the CWES/CBBH certification first, so you arrive with solid web fundamentals. Practise reading unfamiliar source code and building exploits from scratch rather than leaning on tools. Because the report carries real weight, write up your practice work in a clean, reproducible format so report-writing isn’t a new skill on exam day.

SourcesHTB Certified Web Exploitation ExpertHTB Academy subscriptions