OSWE: OffSec Web Expert

What OSWE is and who runs it

OSWE (OffSec Web Expert) is a certification from OffSec — the company behind Kali Linux and the OSCP — earned by completing WEB-300, “Advanced Web Attacks and Exploitation.” Where many web certs test black-box hacking, OSWE is deliberately white-box: you are given application source code and expected to read it, find the vulnerabilities, and chain them into working exploits. It is aimed at people who already have some offensive security and coding background and want to prove they can develop exploits, not just run tools someone else wrote.

Cost and what’s included

OffSec sells it as a course-and-exam bundle rather than a bare exam. The standard “Course + Cert” bundle is $1,749 and includes 90 days of access to the WEB-300 course, its hands-on labs, and a single exam attempt. The “Learn One” subscription is $2,749/year and gives a year of access to one 200- or 300-level course plus labs and two exam attempts, which works out cheaper if you expect to need a retake or want more lab time. Otherwise retakes are purchased separately. The certification itself has no expiration date.

Time: the exam and the report

The OSWE exam is a proctored, hands-on assessment in an isolated VPN. The official limit is 48 hours — precisely 47 hours and 45 minutes — during which you attack a small number of web applications, review their source code, and build proof-of-concept exploits worth four objectives. After the hands-on time ends you get an additional 24 hours to write and submit a professional report documenting your exploitation process. You need 85 of 100 points to pass, and the report is mandatory: a working exploit with no documentation does not count.

How hard it is, honestly

OSWE is challenging but, notably, many find it less time-stressful than OSCP — 48 hours across two nights means pacing and rest matter more than raw speed. The real difficulty is the skill itself: reading unfamiliar codebases, spotting subtle logic and injection flaws, and writing reliable exploit scripts. If your coding is weak, the course will stretch you hard.

Is it worth it — and for whom

OSWE makes most sense for web-app pentesters, bug-bounty hunters, and developers moving into offensive security who want to level up from black-box testing to source-code-driven exploitation. It is a respected specialist credential. It is also expensive and narrow, which makes it a poor first cert — if you are new, OSCP or a foundational web cert should come first. For someone already doing web security work, it is a strong, concrete signal of white-box exploit-development capability.

How to prepare

Get comfortable reading and writing code first — the prerequisites list at least one coding language, Linux familiarity, simple Python/Perl/PHP/Bash scripting, and experience with web proxies. Work through all of WEB-300’s modules and its challenge labs, and practice building a single automated exploit script per target rather than manual steps, since that mirrors the exam pattern. Plan sleep and breaks across the 48 hours, and draft your report template in advance so writing-up is not a last-minute scramble.

SourcesOffSec WEB-300 course & pricingOSWE Exam Guide (47h45m, +24h, 85/100)