Review CWES

Hellooo, my dear reader,

First of all, nice to meet you! I’m Lucas Reis (or luker, or lukerking). I’ve been working in the security field for a few years now, and I also play some CTFs from time to time.

That said, I’m here to share a review of my experience with the CWES. By the end of this article, I hope I can give you some idea of whether it’s worth it for you or not.

TL;DR

If I were starting in the field today, I would definitely buy it.

The course is great, very hands-on, and well structured. There are no live classes, the content is text-based, and there are some labs throughout the “chapters” of the modules. At the end of each module, there is also something like an exam.

If you’re at a junior level, it’s worth it. If you’re already a mid-level professional with good Web Security knowledge, I don’t think it is. If you’re mid-level but don’t have much experience with Web Security yet, then I think it’s worth it. If you’re already senior, it probably isn’t.

1. Context

The course is provided by Hack the Box, and there are a few different ways to get access to it, at least at the time I’m writing this:

• Cubes;
• Silver or Gold subscription;
• Student subscription.

On top of that, if you want to take the certification exam, you also need to pay for the exam voucher, which costs US$210.

In my case, I used the student plan because I’m still in university. It cost around R$45 per month, roughly US$8, and gave me access to all Tier II courses. So for me, it was absolutely worth it.

2. The course

The course itself is extremely well structured and already covers a good amount of what you need to know at a junior/mid-level when it comes to Web Security.

I’ve consumed a lot of Web Security content over the years, both paid and free, and I can honestly say that the cost-benefit here is insanely good.

It starts by giving you a solid foundation on the HTTP protocol, modern architectures used by companies today, and so on.

The labs are very practical. In some sections of the modules, there was basically a small “CTF” that you had to complete, and you needed to finish it in order to move forward.

At the end of each module, there was also an exam-like challenge that required more time and effort, since it reviewed the content covered in that specific module.

3. Studying

When studying: TAKE NOTES ON EVERYTHING. EVERYTHING.

Write down payloads, commands, concepts, and also your write-ups for the final challenges of each module.

Those challenges are more complex and are closer to what you’ll find in the actual exam, so it’s definitely worth documenting what you did and how you got there.

I used Notion because I’m more used to it, but feel free to use whatever note-taking app you prefer: Obsidian, Notepad (LMAOOO), Sublime, and so on.

I also saw some people recommending doing extra labs outside of the course before taking the exam.

Personally, I didn’t feel like it was necessary, but I also already had some pentesting experience. If doing extra labs makes you feel more confident before the exam, go for it.

4. The exam

You get 7 days to complete the entire exam, including the full pentest and submitting the report.

During that period, there are also some flags that you need to submit.

Your final score is based both on the quality of your report and on the flags you managed to capture.

The exam tries to cover a good amount of the content taught throughout the course, so there isn’t really much of a mystery to it. You basically need to apply what you learned and practiced in the labs, and the flags will come.

I found the exam pretty fair, and I didn’t find anything particularly frustrating. You don’t end up stuck in some infinite “rabbit hole,” for example.

In my case, I used SysReptor locally to write the report.

There is a specific SysReptor template made for Hack The Box certifications, which made things much easier. I definitely recommend using it as well.

And it’s one of those things: if you get stuck somewhere, take a break, rest a little, go for a walk. Having a clear head makes a huge difference in exams like this.

Lastly, a good report is one where ANYONE following your steps can reproduce the vulnerability.

So be very detailed with your evidence. Show the full step-by-step process, highlight what needs to be highlighted, and increase the Burp Suite font size before taking screenshots. It helps a lot.

5. Summary

Overall, I had a great time with both the course and the exam.

For someone who is just getting started and wants to become more familiar with Web Security, I would definitely recommend it.

If you already know and are comfortable with the more “standard” Web Security topics, like XSS, SQLi, SSRF, IDOR, and so on, then maybe your profile is already a better fit for something like the CWEE or the OSWE.

If you have any questions or need any help, feel free to message me. I’ll be happy to help!