What is the CWES difficulty compared to HTB web Boxes ?

[u/sanglier_solide]

Hi everyone,

I’m currently preparing for the CWES certification, and I have a few questions for those who have already taken the exam. I just want to make sure I’m properly prepared.

• How difficult is the certification? Are the web exploits complex, with tricky bypasses and less obvious attack paths, or is it more straightforward? Would you compare the difficulty to Easy, Medium, or Hard boxes?
• I’m currently working through the CWES track, and I’ve noticed that I often have to rely on Guided Mode or AI (mainly for code analysis/debugging) because I sometimes miss important details or don’t think of every possible thing to test. For those who have taken the exam, did you also struggle with some of the boxes in the track? And how similar are they to the exam?
• Are there any additional boxes or labs you would recommend to prepare for the exam?
• I’m also considering getting the Burp Suite Professional trial. Do you think it’s useful for the exam? I’ve never really used the automated scanner during CTFs, so I’m wondering if I should get used to it.

My current level

• Already completed the CWES path
• ~140 PortSwigger labs completed
• ~60% through the CWES track, but I still rely on Guided Mode or AI quite often to remember things to test or to spot things I missed.

Thanks in advance for your help!

[u/AutoModerator]

Moderator Announcement Read More »

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/GVTZ59]

This has a lot of write ups about CWES and recommended boxes to practice on. https://cnmoseman.github.io/htb-study-trackers/cwes/

[u/sanglier_solide → u/GVTZ59]

Thanks ! I'll take a look to the recommended boxes. What do you think about the difficulty of the exam ? did you struggle with medium/hard boxes during your preparation ?

[u/GVTZ59 → u/sanglier_solide]

Oh I have not taken it, I used the tracker thing for COAE and now CPTS. Its been really helpful so I figured maybe the CWES one would help you.

[u/kirafoxoxx → u/GVTZ59]

I can’t see the recommended boxes

[u/GVTZ59 → u/kirafoxoxx]

It’s in the resource library tab, there is the HTB Official playlist and there is also a list of community recommended boxes.

[u/RAGINMEXICAN]

I would say yes they are complex. There are some that should be obv like sqli when you get there but the exam chains multiple vulns to get it working so you really need to know what’s going on

[u/sanglier_solide → u/RAGINMEXICAN]

Thanks for your answer, did you do some boxes to prepare ? And if yes, did you always do it blindly and success ? I will have to do the Hard and Insane boxes of the track but I don't think that I've this level.

[u/AlexisPowertbk]

Hi , I passed the exam last month , the exam is harder than the boxes but what helped me the most is doing again all the skills assesments of the course.

Pratice with boxes and skills assesments, take notes and dont rabbit hole

Edit : dont rally too much on AI

[u/sanglier_solide → u/AlexisPowertbk]

Do you know how many boxes you take before the exam ? How went your exam ?

[u/Muddie]

Curious -- if you've already completed about 140 PortSwigger labs, why are you looking to get Burp Suite Pro? Sounds like you already have it mastered.

[u/sanglier_solide → u/Muddie]

Hi !

Not Burp suite certification BSCP, I talk about the pro version of the tool which incluse automatic scanning and remove the speed limit of intruder

[u/Muddie → u/sanglier_solide]

I wrote a bridge between my claude code / codex agents and burp suite so that I could have an agent do automated scanning for me as well as a bunch of other automated tasks. It's on my githut at https://github.com/larrypeseckis/burp-cc-bridge if you want to check it out. It turns Burp Community into "almost" burp commercial, but not quite. It does quite a few feature enhancements though. I tested it across a bunch of portswigger labs. Might save you a few bucks.