My HTB CWES Journey: Taking One Step at a Time

Passing Hack The Box's Certified Web Exploitation Specialist (CWES) was a milestone in my web penetration testing journey. It tested my technical skills, patience, and ability to explain my findings through a professional report.

I want to share how I prepared, how I approached the exam, and what I learned along the way.

About Me

My name is Yasin, and I'm currently pursuing a bachelor's degree in Computer Science. Most of my security work and learning focuses on web penetration testing.

I enjoy exploring web applications, understanding how they work, and figuring out where things can go wrong. But even when you understand a vulnerability, finding it without someone pointing you in the right direction can be a completely different experience.

Why I Chose CWES

Before taking the CWES exam, I had already completed the CWEE Academy path. Still, I wanted to earn CWES first and approach certification one step at a time.

My thinking was simple: taking a huge step before you're ready can make you lose your footing. I wanted to build confidence through smaller steps and put what I had learned into practice.

Completing the CWEE path helped make CWES more manageable for me. That doesn't mean every moment was easy. When you're looking at an application and nothing seems to work, even familiar topics can suddenly feel difficult.

Knowing the material helps, but you still have to stay patient and work through those moments.

Preparation: Three Months in the Academy

My Academy preparation took around three months.

Some of my favorite topics were Attacking Web Applications with Ffuf and Login Brute Forcing. These stood out among the topics I enjoyed throughout the path.

SQL injection was one of the hardest areas for me. It felt like there was so much more to cover than I initially expected. Understanding the basics was only the beginning; working through the different techniques took more effort.

That was an important part of my preparation: accepting that some topics would take longer than others. Finishing a section and feeling confident with it are not always the same thing.

The Exam: Three Days of Exploitation

I spent around three days working through the exam targets and collecting the flags.

My preparation helped, but there were still moments when I felt stuck. Those moments can make you question yourself, especially when you've been trying different approaches without making progress.

For me, that was part of the challenge. You have to keep thinking clearly even when the next step isn't obvious.

One lesson I took from the experience is that frustration can make it harder to notice something you would otherwise recognize. Sometimes, the most useful thing you can do is clear your mind and review the application again from the beginning.

The Report: Finding Flags Is Only Part of the Work

After collecting the flags, I spent about two days writing the report. That brought the main exam work to roughly five days, but I submitted on day seven after spending extra time checking whether anything was missing.

I wanted to be confident that the report explained the work properly.

Finding a flag is not enough. You also need to communicate your findings professionally.

While working through the exam, I saved evidence regularly. After finding a flag, I went through the successful exploitation steps again and captured screenshots for the report.

That made the writing process easier because I had evidence ready to use instead of relying on memory. It also helped me check that the steps I described matched what I had actually done.

The report deserves its own time and attention. It is the part where you turn your technical work into something another person can follow and understand.

What I Learned

The biggest lesson was that preparation and patience need to work together.

The Academy gave me a foundation, and completing the CWEE path beforehand helped. But during the exam, I still had to deal with uncertainty and avoid letting frustration take over.

I also came away with a stronger appreciation for documentation. Saving screenshots and notes throughout the process made reporting much more manageable.

Getting the exploitation working feels great. Explaining it clearly is another skill, and it deserves practice too.

The Waiting

After successfully creating the report and submitting it to the HTB, i waited for around 5 days before i got this exciting email

My Advice to Anyone Preparing

• Take one step at a time. Choose a pace that helps you understand what you're learning and build confidence.
• Give difficult topics enough attention. SQL injection took more effort for me, and it was important to work through that.
• Save evidence as you go. Keep your notes and screenshots organized so you can use them later.
• Make time for the report. Don't treat it as a small task to finish after collecting the flags.
• Don't panic when you get stuck. Clear your mind, return to the beginning, and review your approach carefully.
• Don't skip any of the academy material, as all the exam vulnerabilities are covered there.

The thought I kept coming back to was: the flag is there — you just haven't found the way to it yet.

Getting frustrated doesn't mean you're incapable. Sometimes, you need a fresh look at what is already in front of you. Keep learning, stay patient, and give yourself the time to work through it.