Preface

A few years ago (in 2023), I took the OSCP exam. It felt really good after finding all the flags (even with the bonus points). At that time, you received points only for the Active Directory (AD) part if you obtained domain admin access; otherwise, you received 0 points. I know, scary, right? So, the tactic for it might look like this. Get the full AD part (to get 40 points) + some standalone machines, or just root 3 standalone machines (60 points) + bonus part. Nowadays, the bonus part is over, and if I remember correctly, the AD part has changed (due to an assumed breach). However, at that time, I thought that it was fair and square - the exam. I felt like I worked and learned really hard to get what I wanted. After I did the exam, I decided that one day, I’ll try one of the 300-level courses that Offsec offers. After more than 2 years, I finally bought the WEB-300 (OSWE or AWAE) course with 3-month access (took the Black Friday sale price for ~$1450).

I got asked: “Why did you do it? Do you think it’ll be worth it? You could save the money for a mortgage/car!” Yeah, well, I know all of that, but the main reason I bought it is that I wanted to know that. By “that”, I meant how to approach a web application from the white-box perspective. In my day job as a penetration tester, I mostly work on web applications using a black-box or grey-box approach. But, I did not really do anything with the source code, and I really wanted to know it. I already have a university degree from IT, where coding was… natural? So, why not try the white-box perspective? I was genuinely curious about how to approach it, what to look for, and so on. And that’s why I decided to buy the course and learn something.

So… here is my journey and review!

Before OSWE

So, many of you might ask: “Listen, what did you do to get through the content? Did you prepare in some special way for the course? If yes, what did you do?” I have to admit - I did prepare for it; in fact, I’ve spent numerous days or nights reading through the writeups, blogs, doing the exercises on other platforms, etc. So yes, I would say I have spent a lot of time learning. I think that I did this because (for me) $1450 is a pretty huge amount of money, which I did not want to be wasted; therefore, I wanted to minimize the risks of failing the exam.

So, what I’d recommend reading/doing, or more specifically, what I did:

https://z-r0crypt.github.io/blog/2020/01/22/oswe/awae-preparation/ - this is an extensive list of reading, but it is definitely worth reading! I mean, some articles may not be well-written, but I really suggest you get through them. It was really helpful to see different approaches, code examples, explanations, etc. If you’re curious how much I read from it - except PHP Object Injection/Deserialization, NodeJS Deserialization, Source Code Reviews, Youtube Playlist, and Further Resources, I read everything, and I don’t regret it. It was really worth it.

If I were to recommend only one article from this list, it would be this article: https://klezvirus.github.io/posts/Serialization-A-hidden-threat/

It is a really long article about deserialization, but it was worth it. The author presents different kinds of deserialization attacks across the languages in the OSWE, examples of how to exploit them, and what to look for (as a source code reviewer). It was worth it. It will take some time to read the content and take some notes.

https://pentesterlab.com/badges/codereview - this is a nice start for reading the source code in small pieces and quickly identifying the vulnerability. Do the whole badge so you can understand different types of vulnerabilities, how to spot them, the usual mistakes, and where to look for them.

I have also done some web CTF challenges; however, they were mostly categorized as “easy” since I wanted to first learn on the easier targets to spot common vulnerabilities, so it’d be easier for me to read the code. I did some challenges on https://library.m0unt41n.ch/challenges - I like their platform, so that’s why I did it there. You can also try other platforms…

It is obvious that you should be familiar with common web vulnerabilities, so suggesting portswigger’s labs should go without saying. You don’t need to do all the labs, but you do need a firm grasp of web vulnerabilities. For instance, my progress on these labs is only 67%, so don’t bother.

One more note: the OSWE exam requires you to write the exploit that will get you the admin/user flag and code execution. For this, most participants will use Python. For scripting, this repository might be really helpful https://github.com/rizemon/exploit-writing-for-oswe - I have even used some of the code from it. Huge thanks to the author.

If you did all of this, you should be more than ready for the course content.

However, I also have one side note. Before even thinking about the OSWE, I think I was a little bit lucky. There’s a cool site, called overthewire, on which you can practice bash/shell commands in bandits, but there are also other paths, one of which is natas - web vulnerabilities that you need to exploit, in order to get the flag and proceed to the next level. I really liked it and, in fact, I have even written an exploit for each level, so that I could familiarize myself with the Python requests and re libraries. At that time, I thought that it might be helpful. Nowadays, it sounds so sweet that I thought of a future myself… thank you.

During the OSWE

This was a little bit difficult. If you’re a working person like me, you know there is not a lot of time left in the day to learn things - in my case, work for 8 hours, hit the gym for ~ 1,5-2 hours, go home, rest a little, and finally learn. You don’t have that much time you’d like to spend on the content (in workdays). So that’s why I’ve focused mostly on content on weekends and read a little bit during workdays.

I think my approach was to read/complete one chapter in one week. Therefore, reading 10 chapters (you have 10 vulnerable apps) should take 10 weeks. It might be almost accurate. I started the course on December 27th, and I’ve scheduled my exam for March 20th.

I’d suggest reading and doing all the content that you can. There were some tips/tricks that I did not realize. I did not watch any videos; I’m not even sure if it was needed. I did not read the archived content, though I’d suggest doing so as well. About Extra miles - sometimes, I did them, sometimes, I did not. It’s up to you whether you want to do it. I felt like some extra-mile exercises might be time-consuming, so instead I focused on the content itself.

I have to admit that for some vulnerable apps, I have not written exploit code. I think that I wrote 5 exploits that would get RCE on the machines from the content. Speaking of exploits, in challenges I only did 4 of them (out of 7), wrote exploits for 3 of them, then decided to take a break and just relax (starting March 17th). I decided to take a break because I believed that proper rest is better than rushing through labs/challenges.

It was on March 18th that I had everything prepared. For the report, I’ve decided to go with noraj’s repository - https://github.com/noraj/OSCP-Exam-Report-Template-Markdown - I have used it before, and I think it’s really good! I really recommend using it. Super simple. Just use your desired template, write the content, generate the report, and then upload it to Offsec. I remember it during the OSCP, I was really happy about it :) The template I used was the xl-sec’s one, with a slight change to the title page color.

During + After the exam

So, as you probably know, I can’t tell you specifics about the exam. But what I can tell you is that my exam started on March 20th, 2026, at 09:30 AM. I’ve ended my exam on March 22nd, 2026, at 9:15 AM.

The exam experience was… challenging. I find this word to be pretty accurate. My plan was to start with the first application, finish it by the end of the day, and write a brief report. Then, proceed to the next application on the second day. I was lucky: starting with the first application, I moved forward after 6 hours, and after 5 hours, I was done (except for some report writing, etc.); therefore, my goal was successful. I was also writing some details and providing screenshots for the report, and I went to bed at 01:30 AM.

The next day, I started around 10:00 AM. The first part was relatively fine. I had this part also scripted in like 4 hours. However, the second part was difficult for me - after trying various payloads, tricks, and ideas, I was unable to successfully exploit it. I felt like I fell into a rabbit hole, but I can’t quite confirm or deny it.

I’ve decided I value my sleep more, and after ~ 4 hours of trying various approaches, I focused more on the report part to be good, so that no matter what happens, I’ll still pass the exam. Since I’m writing reports almost daily, this part was quite fine for me. Obviously, no one likes writing reports, but it is essential to showcase your skills. Therefore, on March 22nd, 2026, at ~ 02:30 PM, I submitted the final report and waited for the result.

I already had the result of my exam 5 hours later - I saw it in the offsec portal - when you go to the Exam part of the course, you can see this message:

I was feeling good, like, really good. I really tried to write my report as well as possible, and I am happy it was sufficient. Maybe it was overly verbose, but hey, rather a more detailed report than an insufficient one. So… here is the link and also the image:

Final feelings

The overall experience of the course was… mixed. Some content was great. I really liked the Python SSTI module (ERPNext), but some of the content wasn’t so great (DotNetNuke). Sometimes, it felt like chapters with 10 different applications were written by 10 completely different people with different skill sets.

I really enjoyed the last chapters with code-server setup. If other chapters can also implement and use code-server for debugging, I think it would improve the experience for course-takers. However, this is just my opinion.

I’m glad that I purchased this course - I’m not sure if there is any other course that would offer white-box penetration testing on bigger applications. This was also the reason that I bought this course.

I want to thank all my family members, friends who supported me, colleagues, and many others.

Recommendations for others

Prepare your skeleton script. Really. I mean it. You’ll greatly benefit from it. For me, it was basically just CTRL+C, CTRL+V, with a few modifications. Obviously, you’ll need to implement functionality (such as different endpoints and parameters), but the gist will remain the same.

If you have enough time, check archived content. It might be worth reading through this content, even though it’s old. Old does not necessarily mean that it cannot occur in real life.

Do all the challenge labs. Yes, again, really. It might surprise you, but I definitely regret not doing all the challenge labs. The more code you review, the better you’ll get at code reviews and, therefore, spot the vulnerabilities more quickly. Even when you don’t know what the vulnerability might be (in the challenge labs), you can at least ask on Discord for a hint, or check what others have used.

Learn regex syntax and special operators. Knowing the regex syntax is important in code reviews, since regexes are used by a lot of programmers, and you never know which one you will face in the next application. A helpful site, regex101, can be used to verify and/or explain the regex syntax.