thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

OffSec · Cybersecurity · Expert

OffSec Web Expert (OSWE) exam guide

Exam WEB-300 / OSWE

The OffSec Web Expert (OSWE) proves you can find vulnerabilities by reviewing web application source code and chain them into working exploits you script yourself. It is an advanced, white-box credential for web pen testers and application security engineers.

QuestionsSee official page
Time limit2880 minutes
Passing score85 of 100 points
Exam fee$1,749 USD
Valid forSee official page
DeliveryOnline, proctored by OffSec over VPN

Format: 48-hour proctored practical: source code review and custom exploit development against live targets, followed by a report. Fee note: Course + Cert Bundle with 90 days access and 1 attempt; Learn One $2,749/year with 2 attempts.

Who it's for

Experienced web pen testers, AppSec engineers and developers comfortable reading code in several languages.

What the exam covers

Source code analysis—
Authentication bypass—
Injection (SQLi, command, template)—
Deserialization—
Cross-site scripting chains—
Server-side request forgery and type juggling—
Exploit scripting and automation—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None formal.

Recommended: Comfort with at least one programming language, writing Python/PHP/Bash scripts, web proxies such as Burp Suite, and PEN-200-level offensive skills.

Keeping it active

None; OSWE does not expire.

Skills & careers

Skills it validates

  • White-box code review in multiple languages
  • Chaining vulnerabilities to remote code execution
  • Bypassing authentication logic
  • Exploiting deserialization and injection flaws
  • Writing reliable exploit scripts in Python
  • Debugging web applications

Job roles

Application Security EngineerWeb Application Penetration TesterSecurity Code ReviewerProduct Security EngineerBug Bounty Hunter

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Month 1: Work through WEB-300 modules, debugging each app as you go.
  2. Month 2: Recreate every exploit chain from scratch as a single Python script.
  3. Month 3: Practise code review on open-source apps and the extra lab machines.
  4. Month 3: Do a timed mock and write the report, then book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Build reusable script templates (HTTP sessions, payload encoding) before the exam.
  • Your exploit must run end to end; partial manual steps cost points.
  • Use the debugger provided to trace code paths rather than guessing.
  • Plan sleep across the 48 hours; you also get 24 hours afterwards for the report.

Key terms for this exam

All 22 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much is OSWE?

The Course + Cert Bundle is $1,749; Learn One is $2,749 per year.

Does OSWE expire?

No.

Do I need OSCP first?

Not formally, but OffSec expects PEN-200-level skills.

How long is the OSWE exam?

48 hours, plus 24 hours to submit the report.

OSWE vs GWAPT?

OSWE is white-box exploit development; GWAPT is black-box testing methodology.

Official page: www.offsec.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.