OSWE
OffSec Web Expert · OffSec
The OSWE validates white-box web application testing: reading source code to find complex vulnerabilities (deserialisation, authentication bypass, blind SQL injection, session hijacking) and chaining them into a working exploit. It is one of the most respected certifications in application security and part of the OSCE³ trio. Its strength is that it proves real code review and exploit-writing skills; its limit is a demanding, long exam that assumes you already read several programming languages comfortably.
- Exam
- Proctored practical exam of 47 h 45 on web applications whose source code you can review, pass mark 85/100, then 24 h to submit the report.
- Exam price
- Sold with the trainingExam not sold alone: Course + Cert Bundle (90 days of WEB-300, one attempt) US$1,749, or Learn One subscription US$2,749 a year (two attempts). Retake: US$249.
- Required experience
- None formally. In practice: solid web penetration testing experience and the ability to read several languages (PHP, Java, .NET, JavaScript, Python).
- Validity and maintenance
- Valid for life: no expiry date and no maintenance fee. Counts towards the OSCE³ and can renew an OSCP+.
- Format
- Hands-on
Who is it for?
Experienced web penetration testers, AppSec engineers, security code reviewers and developers who want to prove they can find and exploit flaws in source code.
Domains covered
- Source code analysis and manual code review
- Static and dynamic analysis, fuzzing
- Authentication bypass
- Blind SQL injection
- Persistent XSS and session hijacking
- Advanced server-side request forgery
- Deserialisation flaws (.NET and others) leading to remote code execution
- Custom exploit development chaining several flaws
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
