OSWE Study Guide — Advanced Web Attacks | FsKnockouT

The Offensive Security Web Expert (OSWE), gained through the WEB-300 / AWAE course, is arguably the deepest hands-on web-exploitation certification on the market. It is a 48-hour practical exam that tests your ability to read application source code, identify vulnerability chains, and write custom exploit scripts that produce consistent, reliable payloads. This guide covers the exam format, the specific skills that matter, a realistic 16-week study plan, and how FsKnockouT's walkthroughs support your preparation.

What OSWE is

OSWE is a 48-hour white-box web-exploitation exam. You get access to two vulnerable web applications along with their complete source code. Your task is to review the code, identify a vulnerability chain that leads to remote code execution or authenticated admin takeover, and then write a working exploit script that reproduces the attack from scratch — not just manual Burp requests, but a Python (or language-of-choice) script that executes the full chain reliably.

After the 48-hour practical window, you have an additional 24 hours to write and submit a professional report documenting both chains with working exploit code.

Who OSWE is for

  • Senior web application pentesters who want to prove white-box depth.
  • Red-teamers specialising in external perimeter attacks.
  • Developers transitioning into application security who want hands-on credibility.
  • OSCP holders ready for the next practical Offensive Security certification.
  • Bug-bounty hunters who want to formalise source-code-review skills.

Exam format and scoring

You get 47 hours and 45 minutes of hands-on time plus a 10-minute mandatory break, followed by a 24-hour report window. The exam contains two applications:

  • Each application has a defined objective — typically authentication bypass leading to RCE, or authenticated admin takeover leading to file-system access.
  • Each application is worth 50 points.
  • Passing requires 85 points total, meaning you need a complete chain on at least one application plus significant progress on the second.
  • Both the working exploit script AND the final RCE/takeover are required for full points.

Unlike OSCP, OSWE is white-box — the full application source code is provided. The exam is about your ability to read and understand application code quickly, spot the vulnerability patterns, and automate exploitation reliably.

Common failure points

  1. No source-code reading muscle. Candidates who never trained reading unfamiliar codebases spend the first 10 hours just orienting themselves in the application structure.
  2. Burp-first reflex. OSWE rewards reading code first, then validating with Burp. Candidates who jump straight to Burp waste hours on blackbox discovery of findings that would be obvious in the source.
  3. Exploit-script neglect. You MUST submit a working, reproducible exploit script. "I did it manually in Burp" does not pass. Candidates who delay writing the script until hour 40 run out of time.
  4. Technology-stack unfamiliarity. OSWE exam applications span Java, .NET, Python, PHP, and Node.js. Candidates who only know one stack get blindsided when their chain is in an unfamiliar language.
  5. Deserialisation gap. Java and .NET deserialisation attacks are a frequent pattern. Candidates without hands-on deserialisation practice miss the chain entirely.

Study timeline (12-16 weeks)

  • Weeks 1-4: WEB-300 course videos + guided exercises. Finish every module, understand every example chain.
  • Weeks 5-8: WEB-300 labs. Complete every application in the lab environment. Rebuild each exploit from scratch without looking at your notes.
  • Weeks 9-10: Supplementary labs — Hack The Box's White Rabbit, Blue Water, and the OSWE-like pro labs. Practice reading unfamiliar code fast.
  • Weeks 11-12: Language-stack drills. Build small vulnerable apps in Java, .NET, Python, PHP, and Node.js and chain simple vulnerabilities in each.
  • Weeks 13-14: Full mock exam using retired OSWE-like boxes. Include report drafting in the mock.
  • Weeks 15-16: Report-template polish and exam scheduling.

Recommended practice

FsKnockouT maintains the OSWE Latest Exam Walkthrough covering current-pool scenarios, and the OSWA Lab Challenge Guide for foundational web-exploitation practice at a lower difficulty. Together these give you exam-pool exposure plus a gradient from lab to exam.

Frequently asked questions

How much does the OSWE exam cost?

The WEB-300 course with 90-day lab access and exam voucher is typically around $1,649 USD. Additional lab time and exam retakes cost extra.

Is OSWE harder than OSCP?

OSWE is more narrowly focused (web only, white-box) but deeper than OSCP in its specialty. Most candidates find OSWE's source-code-reading requirement the bigger mental shift.

Do I need programming skills?

Yes. You must write exploit scripts in Python or a similar language, and you must read source code across multiple stacks. Light scripting ability is a hard minimum.

What languages appear in the exam?

Java, .NET, Python/Flask/Django, PHP, Node.js all appear in the OSWE exam pool at various times. The specific stacks on your exam are random.

What is the pass rate?

Historically around 35-40% first-attempt. Second-attempt pass rates are substantially higher.

Can I use Burp Suite Professional?

Yes. Burp Suite is the main HTTP tool during OSWE. The exam is still graded on your automated exploit script, not on manual Burp exploitation.

Can I use ChatGPT during the exam?

You may use publicly available tools including language models. You may NOT ask another human. The exam work must be your own.

Ready to prepare?

Pick up the OSWE walkthrough, practice with OSWA foundational labs, and message @FsKnockouT on Telegram for pay-after-pass remote support during the 48-hour exam window. Related reading: BSCP study guide and OSCP study guide 2026.