OSWE certification: exam, cost and WEB-300 training
OSWE — OffSec Web Expert — is OffSec’s certification for white-box web application exploitation, earned through the WEB-300 course. The exam is hands-on and proctored: 47 hours and 45 minutes to exploit several target machines, then 24 hours to submit a report; you need 85 of 100 points. The cheapest route is the US$1,749 Course + Cert Bundle with one exam attempt. OSWE does not expire.
- Certification
- OffSec Web Expert (OSWE), issued by OffSecOffSec WEB-300 page, checked 10 October 2026
- Official course
- WEB-300: Advanced Web Attacks and Exploitation, 105 hours of contentOffSec WEB-300 page, checked 10 October 2026
- Cost
- US$1,749 Course + Cert Bundle (1 attempt); US$2,749/year Learn One (2 attempts)OffSec WEB-300 page, checked 10 October 2026
- Exam duration
- 47 hours 45 minutes, then 24 hours to submit the reportOffSec OSWE Exam Guide, checked 10 October 2026
- Passing score
- 85 of 100 pointsOffSec OSWE Exam Guide, checked 10 October 2026
- Format
- Hands-on exploitation of several target machines; working exploit script per machine plus a written reportOffSec OSWE Exam Guide, checked 10 October 2026
- Delivery
- Online, proctored by OffSec over a private VPNOffSec WEB-300 page and Exam Guide, checked 10 October 2026
- Prerequisites
- None stated by OffSec on the WEB-300 page or FAQOffSec, checked 10 October 2026
- Validity
- Does not expire; no annual maintenance feeOffSec Certification Exam FAQ and AMF FAQ, checked 10 October 2026
Know if you're ready for OSWE — before you book.
Certsqill measures your OSWE readiness across every official exam domain — one 0–100 score from coverage, accuracy and consistency that tells you whether to book, keep studying, or sit.
Why people switch to Certsqill
Everything you need to walk in ready
Know where you stand, understand every mistake, and study in your language — one payment, no subscription.
Your OSWE Readiness Score, not a guess
One number from three signals — coverage, accuracy, and consistency — tells you whether to book the exam or keep studying.
Understand every OSWE mistake
When you miss a question, it explains why — using your own answer history to catch the patterns you keep repeating. Included, no subscription.
Explanations in your language, questions stay exam-accurate
Get every explanation in your language while the questions stay in exam-accurate English. Technical terms stay in English — the way the exam writes them.
Everything you need to pass
Why you can trust these OSWE questions
What is the OSWE certification?
OSWE stands for OffSec Web Expert. It is OffSec’s web application security certification at the 300 level, and you earn it by passing the exam attached to WEB-300: Advanced Web Attacks and Exploitation.
OffSec describes WEB-300 as an advanced web application security course that teaches the skills needed to conduct white-box web app penetration tests. White box is the key word: you work from the application’s source code, find the flaws by reading it, and then chain them into a working exploit.
That makes the OSWE cert different from black-box web testing credentials, where you attack an application without seeing its code. OffSec’s course page carries a learner testimonial recommending it to full-stack developers, but OffSec does not publish a formal target audience.
Source: OffSec — WEB-300: Advanced Web Attacks and Exploitation. Checked 10 October 2026.
How much does the OSWE certification cost?
OffSec does not sell the OSWE exam on its own on the WEB-300 page; it comes with course access. Three options are listed. The Course + Cert Bundle costs US$1,749 one time and includes 90 days of access to one 200- or 300-level course and a single exam attempt. Learn One costs US$2,749 a year and includes one year of course access and two exam attempts. Learn Unlimited costs US$6,099 a year and includes unlimited exam attempts.
If 90 days is not enough, OffSec lets bundle buyers extend lab access in 30-day increments, and additional exam attempts can be bought through the Buy More option, subject to a cooling-off period between attempts. OffSec does not show a standalone retake price on the pages checked.
- Course + Cert Bundle: US$1,749 one time — 90 days, 1 exam attempt
- Learn One: US$2,749 per year — 1 year, 2 exam attempts
- Learn Unlimited: US$6,099 per year — unlimited exam attempts
Source: OffSec — WEB-300: Advanced Web Attacks and Exploitation. Checked 10 October 2026.
OSWE exam format: how the 48-hour exam works
OffSec markets the OSWE exam as 48-hour proctored; the exam guide gives the exact limit as 47 hours and 45 minutes. The exam consists of several target machines. For each one, your objective is a single functional script that exploits multiple vulnerabilities on that machine; if you cannot get a reverse shell, the proof-of-concept script should extract the proof values automatically.
After the exam you have 24 hours to submit a report, which must include the source code of your custom exploits. Missing proof files or documentation can cost points, so the report is part of passing, not an afterthought.
The exam is proctored by OffSec over a private VPN, and all of your work has to happen on the machine running the proctoring software.
Source: OffSec Help Center — WEB-300 OSWE Exam Guide. Checked 10 October 2026.
OSWE passing score
The OSWE exam has a maximum of 100 points, and you need at least 85 to pass. That is a high bar compared with many certifications: there is little room to leave a machine half-finished.
With 85 points needed out of 100, plan to complete every target fully, with a working end-to-end exploit script and the documentation to back it up.
Source: OffSec Help Center — WEB-300 OSWE Exam Guide. Checked 10 October 2026.
What tools are allowed on the OSWE exam?
The exam guide prohibits automatic exploitation tools such as SQLmap and SQLninja, and mass vulnerability scanners such as Nessus or OpenVAS. The guide, last updated in July 2026, also states that using LLMs and AI chatbots — OffSec’s own KAI, ChatGPT, Deepseek, Gemini and others — is strictly prohibited.
Tools such as Nmap and its scripting engine, Nikto, Burp Free and DirBuster are allowed. In practice, that means the vulnerabilities have to be found by reading code and debugging, and the exploits written by you.
Source: OffSec Help Center — WEB-300 OSWE Exam Guide. Checked 10 October 2026.
OSWE syllabus: what WEB-300 covers
OffSec lists the WEB-300 syllabus as ranging from advanced SSRF, persistent XSS and blind SQL injection to .NET deserialization, along with source code analysis, session hijacking, fuzzing and authentication bypass. The course has 105 hours of content.
The exam tests the same skill: reading unfamiliar application code, spotting the flaw, and turning a chain of flaws into one automated exploit. Expect to read and write code throughout the course rather than drive point-and-click tools.
- Source code analysis and white-box methodology
- Advanced server-side request forgery (SSRF)
- Persistent cross-site scripting (XSS)
- Blind SQL injection
- .NET deserialization
- Session hijacking
- Fuzzing
- Authentication bypass
Source: OffSec — WEB-300: Advanced Web Attacks and Exploitation. Checked 10 October 2026.
OSWE prep and training
The official training for the OSWE exam is WEB-300 itself, delivered on OffSec’s own learning platform with labs. OffSec does not list formal prerequisites on the WEB-300 page or the WEB-300 FAQ, but this is a 300-level course: comfort reading code and writing your own scripts makes the 105 hours far more productive.
For exam prep, practise the full loop on lab applications — find the bug in source code, prove it manually, then automate the whole chain into one script that runs cleanly from start to finish. Write report notes as you go, because the 24-hour reporting window comes after a long exam.
Source: OffSec — WEB-300: Advanced Web Attacks and Exploitation. Checked 10 October 2026.
Does the OSWE cert expire?
No. OffSec states that once you earn an OffSec certification it remains valid indefinitely, apart from a list of exceptions such as OSCP+. OSWE is not one of the exceptions.
OffSec’s Annual Maintenance Fee of US$145 a year applies only to the expiring certifications — OSCP+, OSAI+, OSCC-SEC, OSCC-SJD, OSTH and OSIR. OffSec lists OSWE among the certifications that do not expire and do not require annual maintenance.
Source: OffSec Help Center — Annual Maintenance Fee (AMF) FAQ. Checked 10 October 2026.
OSWE exam integrity
OffSec lists sharing, leaking or using exam materials, reports or solutions as cheating, alongside collaborating with or receiving help from others during an exam. If a violation is confirmed, the consequences include not receiving the certification, revocation of certifications already issued, and a lifetime ban from future OffSec courses and offerings.
OffSec also notes that if someone else uses your exam report, your own certification can be reviewed and revoked regardless of how long ago you passed — so keep your report private.
Source: OffSec Help Center — Cheating on a certification exam. Checked 10 October 2026.
Is the OSWE certification worth it?
It depends on the work you want to do. OSWE proves something specific and hard to fake: that you can read an application’s source code, find chained vulnerabilities and automate an exploit under exam conditions with an 85-point pass mark. For web application penetration testing and application security roles, that is directly relevant.
The cost is US$1,749 at minimum, and the certification does not expire or carry a maintenance fee. OffSec does not publish salary figures for OSWE holders, so this page does not quote any.
Source: OffSec Help Center — OffSec Certification Exam FAQ. Checked 10 October 2026.
OSWE practice questions
Certsqill’s OSWE practice questions are expert-developed, each answer option has its own explanation, and you see a readiness score per domain. They are meant for the knowledge side — vulnerability classes, code patterns, exam rules — and do not replace hands-on lab work for a practical exam like this one.
OSWE questions people ask
What is the OSWE certification?
The OffSec Web Expert, OffSec’s certification for white-box web application exploitation, earned through the WEB-300 course exam. Source: OffSec, checked 10 October 2026.
How much does OSWE cost?
From US$1,749 for the Course + Cert Bundle with 90 days of access and one exam attempt; Learn One costs US$2,749 a year with two attempts. Source: OffSec, checked 10 October 2026.
How long is the OSWE exam?
47 hours and 45 minutes for the exam, then 24 hours to submit the report. Source: OffSec OSWE Exam Guide, checked 10 October 2026.
What is the OSWE passing score?
85 out of 100 points. Source: OffSec OSWE Exam Guide, checked 10 October 2026.
Is the OSWE exam proctored?
Yes. All OSWE exams are proctored by OffSec. Source: OffSec OSWE Exam Guide, checked 10 October 2026.
Can I use AI tools in the OSWE exam?
No. The exam guide states that using LLMs and AI chatbots is strictly prohibited, as are automatic exploitation tools and mass scanners. Checked 10 October 2026.
Does OSWE expire?
No. OffSec lists OSWE among certifications that do not expire and need no annual maintenance. Checked 10 October 2026.
Which course leads to the OSWE certification?
WEB-300: Advanced Web Attacks and Exploitation, with 105 hours of content. Source: OffSec, checked 10 October 2026.
What OSWE salary can I expect?
OffSec does not publish salary figures for OSWE holders, so this page does not quote any.
