Not for the certificate: my experience with HTB CWES

Introduction and Motivation

I’ll make it clear right away: this is not a step-by-step guide. There won’t be a detailed breakdown of the exam, spoilers about the machines, or any secret techniques. This is more of my personal perspective on HTB CWES (Certified Web Exploitation Specialist): why I even went there, how the training went, what I felt during the exam, and what conclusions I drew for myself.

A separate interesting question is how to manage all of this when you have a job, a family, kids, and a dog that always seems to need something at the exact moment when you sit down to study peacefully. I think many can relate to this story. In my case, it all hinges on planning and on the fact that I try to treat learning not as something additional that I do if I have time left over, but as an important part of my development. It doesn’t always work out perfectly, of course, but without a system, I simply wouldn’t be able to pull these things off.

To be honest and not hypocritical, my main motivation is quite simple — it’s money 😂. Money through career growth, experience, and becoming a stronger specialist. The stronger you are in your profession, the more opportunities you have: more interesting projects, higher market value, more options for growth. I don’t have a beautiful story about calling, a lifelong dream, or how I’ve been striving for this since childhood. I just like becoming stronger in what I do and seeing how it yields results.

At one point, my friend and colleague really motivated me. He is a very strong specialist and earns well. At some point, he shared his development roadmap with me, and I really resonated with this approach. Not in terms of blindly repeating it, but in terms of looking at the path of someone for whom it has already worked and taking what personally suits me from it.

That said, I didn’t come here just for the certificate itself, but specifically for the knowledge. The certificate is cool, no doubt, but for me, it’s more of a bonus rather than the main goal. There is currently a lot of free material available online, and that’s really great. Huge respect to self-taught individuals who create their own programs, dig into topics, filter out the noise, and gradually figure everything out. That’s a strong path.

But personally, I prefer a different format. I like when learning is structured systematically, step by step. When you are not thrown chaotically between topics, but are guided along a proper route: from the basics to more complex things. This way is more convenient, calmer for me, and, to be honest, more effective. That's why at some point I decided to take CWES—not for a line on my profile, but to gain exactly that kind of structured experience.

Why I chose CWES

At the start, I already had experience in web pentesting, but I wanted to do more than just scratch the surface of individual topics; I wanted to go through a more comprehensive and systematic track. So that there wouldn’t be a situation where you know something, have already touched some things in projects, but still have a sort of mess in your head.

Plus, I was interested to see how HTB structured the training specifically in this direction. After all, it’s one thing to have free materials and random notes, and another to follow a collected program and be able to properly assess what you gained from it.

How the training went

I enjoyed the training. In fact, I really liked it.

At one time, I went through material from PortSwigger, but CWES resonated with me better. I think several factors played a role here. First, I wasn't taking it at the beginning of my career, but with some experience behind me. Second, the training format turned out to be closer to me.

The learning track went quite quickly. I purchased the subscription before the New Year, just as the New Year holidays were coming up, and I spent all the days during those holidays studying. The entire training took about a month. Along the way, there were topics that were new to me. There were also things I had encountered before, but here they became much clearer and better organized in my mind. I particularly liked that after the course, I had a proper outline left, something practical: notes, approaches, ideas that I could quickly rely on in my work later. And this is probably one of the main advantages of the course for me personally: the knowledge didn’t get stuck somewhere within the platform. I really started applying some of the things in projects.

What’s important to understand about the exam in advance

The exam here is not just a story for a couple of evenings. You need to prepare properly for it, including managing your time.

It lasts 7 days, and this period includes not only the technical part itself but also writing the report. This is an important point to keep in mind from the very beginning. Because seven days sound like a lot of time, but in reality, time flies quickly: sometimes you get stuck, sometimes you hit a wall, sometimes you double-check yourself, and then you also need to format everything properly.

There is a free retake and advice from the platform on preparation, but there is an important nuance here: if you do not submit the report at all on the first attempt, even an empty one, then the retake expires, and there will be no more advice. This is something that is better to know in advance rather than after the fact.

The first attempt and emotions

I did not pass the exam on the first try.

I collected about half of the flags. And it quickly grounded me. It’s a very useful experience, although at the moment, of course, it’s not pleasant. The exam quickly shows that repeating study scenarios is not enough. Some machines really require you to change your perspective. Not to go by the template, but to stop and think that maybe you’re looking in the wrong direction or thinking too linearly.

Well, and of course, attentiveness. This is the foundation!!! Sometimes everything boils down not to a lack of knowledge, but to some missed detail, due to which you waste a lot of time going in the wrong direction.

Before the exam, it’s very easy to get worked up. And here, by the way, the advice from that very friend I mentioned at the beginning helped me. He suggested taking the exam a bit easier: not as the drama of a lifetime, but as a game. With enjoyment, for fun, with interest—call it what you like. The point is not to give the exam too sacred a significance. It is important, yes, but it’s not an event that divides life into before and after. When you look at it this way, it becomes easier to keep a cool head, to be less tense, and just to work.

These were 7 days of very intense focus and complete immersion in the process. You test hypotheses, hit walls, roll back, try differently, look again, think again. And what I also liked: despite the stress, the exam left mostly good impressions. It was hard, but the emotions you get with each found flag are beyond words.

Is it worth it?

If we look at it honestly, the main result for me is not the certificate itself, but that the training actually provided benefits.

I received a systematic track in web development, a good summary, a better understanding of several topics, and things that I later began to use in my work. For me, the value was in the process and in the outcome in terms of skills. And on top of that, the certificate laid as a conclusion to this whole story.

In my opinion, yes — if you are comfortable with such a format.

If you can calmly and confidently learn completely independently, gather materials piecemeal, build your own program, and not get lost in the volume of information, then perhaps you can grow wonderfully even without such a course. And this, I repeat, is a strong path.

But if, like me, you find it easier and more effective to follow a structured route where the material is presented sequentially, then in this regard, CWES seemed to me to be a very good option.

What’s next?!

Right now, I am taking the next, more hardcore step in web development at HTB — CWEE (Certified Web Exploitation Expert).

There, the techniques are more complex and there is a greater emphasis on the white-box approach. For me, this looks like a logical continuation and a good step towards moving towards OSWE in the future.

Conclusion

In the end, I can simply say: I was satisfied with the training.

Yes, I did not pass the first attempt at the exam. Yes, it was difficult at times. Yes, the exam tests not only knowledge but also attention, composure, and the ability not to fall apart when something takes a long time to achieve.

So if you need not just a certificate but a systematic and step-by-step track in web development, then CWES, in my opinion, deserves attention.

If you are currently studying, preparing for certifications, or just want to become stronger in your profession — I wish you success. Don’t burn out, don’t overwhelm yourself with unnecessary importance, and enjoy the process. The rest will follow!