If you’d been eyeing HackTheBox’s CBBH and suddenly can’t find it, you’re not losing it: since October 1, 2025 it’s called CWES (Certified Web Exploitation Specialist). It isn’t a new cert; it’s the same CBBH renamed, with the path reshuffled and a couple of new modules. Anyone who already held it got it upgraded automatically, Credly badge included. Since I’ve just gone back over it with the change already in place, here’s my review.
What the CWES is
It’s HackTheBox’s web certification: fully hands-on, intermediate, and focused on web applications only. The new name fits what it actually tests better; “Bug Bounty Hunter” sold it short, because the cert was always more web pentest than chasing bounties.
You prepare for it with the Web Penetration Tester path (formerly “Bug Bounty Hunter”), around 20 Academy modules. With the rebrand they refreshed close to half of the material to bring it up to date.
The training
The path runs from the basics to the real thing: HTTP requests, using proxies, information gathering, fuzzing, and from there the whole run of web attacks —SQLi, XSS, command injection, file inclusion, file upload, server-side (SSRF, SSTI), auth attacks…— all the way to the report. The genuinely welcome additions:
- API Attacks, nicely focused on REST.
- Attacking GraphQL, which is exactly what was missing to stop being stuck on ten-year-old web apps.
- Attacking Common Applications, broader than the old WordPress-only module.
- A refreshed Web Fuzzing.
The format is the usual HTB Academy one: lots of text and images, zero videos. It’s dense and it drags, but it’s well written and each module ships its exercises with real targets to practise what you just read. If you come from video courses, the change of pace stings; in exchange, what sticks, sticks better.
The exam
This is where the cert earns it. You get 7 days total to attack and to write, against a set of real web applications on the platform (the community says around five). On every target the goal is the same: reach administrator and land RCE. Finding a lone bug isn’t enough; most of the time you have to chain several vulnerabilities to get to the end, which is exactly what happens in a real engagement.
To pass you need a high score —the community puts it around 8 of 10 flags— and, what a lot of people underrate, a professional-grade report. The report isn’t a formality: it genuinely weighs on the grade and HTB reviews it like a client deliverable. You can use the Pwnbox or your own VPN and tools, doesn’t matter.
One detail your wallet will appreciate: if you submit a report on the first attempt, you get a second attempt at no extra cost.
The good and the bad
In its favour:
- The exam is genuinely realistic. Chaining bugs against full apps feels far closer to a real pentest than grabbing isolated flags.
- Seven days give you room to think without the absurd pressure of a 24-hour OSCP.
- The API and GraphQL modules finally bring the cert up to date.
- The report forces you to communicate, which is half the job and where technical people struggle most.
Against it:
- It’s all text. If you hate reading screens, it’s going to be a slog.
- It isn’t a from-zero cert: without a minimum web foundation, the modules will feel like a wall.
- The report eats time. Better to keep it current during the exam than leave it for the end.
Who’s it for?
If you want to go into web pentest or AppSec, or shore up that side of a more generalist profile, the CWES is one of the best value-for-money certs out there, especially if you grab the annual subscription when it bundles exam vouchers. For pure bug bounty it also works as an orderly foundation, though the old name sold that angle better.
If you’re starting completely from scratch, warm up first with more introductory material; the CWES assumes you already know your way around an HTTP request and can read a response without flinching.
