OSWA
OffSec Web Assessor · OffSec
The OSWA validates black-box web application testing: discovering and exploiting cross-site scripting, injections, server-side request forgery, template injection and other common flaws, in a fully practical exam. It is less famous than the OSWE but fills a gap for web testers who do not have access to the source code. Its strength is a realistic, hands-on exam; its limit is that it is still little known to recruiters and does not cover code review.
- Exam
- Proctored practical exam of 23 h 45 on five web targets, pass mark 70/100 (partial points possible), then 24 h to submit the report.
- Exam price
- Sold with the trainingExam not sold alone: Course + Cert Bundle (90 days of WEB-200, one attempt) US$1,749, or Learn One subscription US$2,749 a year (two attempts). Retake: US$249.
- Required experience
- None formally. Comfort with HTTP, JavaScript and at least one server-side language is strongly advised.
- Validity and maintenance
- Valid for life: no expiry date and no maintenance fee.
- Format
- Hands-on
Who is it for?
Web penetration testers, bug bounty hunters and AppSec engineers who want to prove their black-box skills before moving on to the OSWE.
Domains covered
- Web application reconnaissance, enumeration and wordlists
- Burp Suite tooling
- Cross-site scripting (XSS)
- SQL injection with fuzzing tools and sqlmap
- Cross-site request forgery and CORS
- XML external entities (XXE)
- Server-side template injection (SSTI)
- Server-side request forgery (SSRF)
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
