Hey everyone, welcome back to my blog. I know, I know, it's been a while, honestly way too long since my last post. Life got busy, certs got done, and somehow writing about it kept getting pushed back. But here I am now, back with not one but two blogs dropping at the same time, so grab a coffee because we have a lot to cover.
This blog is solely about my OSWE experience which I completed on October 23, 2025, and you can read about my OSED experience separately here. Both of them together got me the OSCE3 which is pretty wild to say out loud, but let's not get ahead of ourselves, one cert at a time.
My last blog was about my OSEP experience, go check it out if you haven't already.
I won't go into deep detail about what OSWE is since you can find that info on their website, but in short, it's a whitebox web certification where you learn how to approach a whitebox pentest, analyse source code to find vulnerabilities, and chain them toward a specific objective. Check their website for the full syllabus, but since you're reading this you probably already know what it is, so let's talk about requirements.
Personally I did it without going through the PortSwigger course first, which a lot of people suggest. I won't say it wouldn't help, it probably would, but in my case I was already familiar with the concepts through CPTS, NSD, and OSCP. And since OSWE is whitebox, I figured I wouldn't need the full PortSwigger knowledge bank and just went for it. No regrets, but I'd still say it can help if you feel like you need the foundation.
As for scripting, I'll drop some resources in the appendix below that I personally used along the way. Python only is completely fine, and you really just need the basics. Everything else follows with practice, trust me. You won't learn coding from tutorials, you learn it by jumping into projects, and OSWE is your project now. If you know if/else, for loops, while loops and the like, you're good to go. Jump in.
I won't lie, when I started the course I was motivated. The content is solid and based on my experience with OSEP, the 300-level OffSec courses are generally well done. That said, OSWE was the weakest of the three in my opinion. It walks you through the material, shows you a vulnerability they already found, and then vaguely tells you to follow some steps, but never really explains the approach or what they tried before finding it. That part is important if you want to actually build a methodology for finding vulns, and it was lacking in a good chunk of the modules. Everything else was top notch, but that specific thing bothered me.
Don't worry though, because the real learning happens in the labs. Once I moved to labs I started actually developing the methodology I was missing. When I finished the course I honestly felt like I understood nothing and had zero methodology. The labs fixed that. I did all of them except the last one (squeaker, you know who you are). In total I spent around two months on the course, reading, taking notes, watching videos, and then another month on labs, so three months total. After that I felt confident enough to attempt the exam.
What everyone says is true, the exam is challenging but very doable if you put the work into the course and especially the labs. The only thing that can really hold you back if you know your stuff is stress, and stress will straight up block your brain from thinking clearly. Stay chill, take breaks, you have 48 hours for a reason. It's not because the exam needs 48 hours of your life, it's because you're a human being who needs to sleep, eat, and exist. They built the time buffer for that.
I hit a lot of dead ends during my exam. The first challenge was relatively quick for initial access, but I got stuck on RCE for a while. Moved on to the second challenge which was honestly tricky for initial access, but I eventually figured out what I was missing (please, please get comfortable using a remote debugger, it's genuinely a life changing skill for this cert). RCE on the second one was straightforward after that. At that point I had 85/100 so I knew I had enough to pass. I knew the RCE path for the first challenge too but didn't want to burn time on it since scripting was still ahead of me.
Scripting was the rough part. I had encoding issues I hadn't anticipated, like making sure everything is URL encoded before your script sends requests, and if you're using curl-based flows sometimes a specific encoding step needs to happen before the command fires. Lesson learned. Everything was also slow to execute so the minutes waiting for scripts to finish felt like actual hours, but they spit out the flags as intended and I was happy. I finished with 4 minutes to spare by the way. Cutting it close, classic.
The note-taking and scripting I did throughout the labs saved me in the exam, I basically had templates ready to go. Do not skip scripting the labs.
Take your time in the course, note everything you think could be useful, and script every single lab exercise including the extra labs. Trust me, when exam time comes you'll feel confident because it's all just practice at that point.
Take breaks during the exam, even when you feel like pushing through. Resting every 3 to 4 hours or after getting a flag keeps your brain fresh the whole way through. I personally did this until scripting gave me problems and then I pulled an all-nighter fixing encoding issues, so, do as I say not as I do.
Stress and nervousness are basically unavoidable, you'll always feel like you're not ready. But you've probably felt this before in other exams or life experiences and got through it anyway, so treat this the same way. Go in with the mindset that you'll crush it, because you probably will.
Use LLMs to help with scripting during the course and labs. They're great for understanding what your code is doing and building reusable templates.
Ask for help in the Discord when you're stuck. I personally lurk in the rooms and try to help people out when I can.
Enjoy the process. Happiness in these certs isn't just about passing, it's about getting stuck, feeling completely lost, and then suddenly clicking everything into place and feeling like you can do anything. And keep in mind this is a beginner cert in the web space, you'll learn the knowledge and skills needed but don't expect to come out as a web expert. Experience teaches things that no cert ever will.
Resources I found useful for preparation and scripting:
That's it for this one. If you have any questions feel free to follow me on LinkedIn and shoot me a message, I'm always happy to help. Thanks for reading, hopefully it was useful, keep pushing !!