OSWE — OffSec Web Expert
OffSec's advanced web application exploitation certification and one of the most technically demanding AppSec credentials available. Unlike black-box web testing, OSWE focuses entirely on white-box testing — reading source code to identify and chain vulnerabilities for remote code execution. The 47h 45m practical exam requires genuine programming knowledge and the ability to build custom exploit scripts. OSWE teaches a distinct and complementary skillset to BSCP — the white-box approach is what separates senior AppSec practitioners who understand code from those who just operate scanners.
| Issuer | OffSec |
|---|
| Level | expert |
|---|
| Domains | Offensive Security, Application Security |
|---|
| Practical weight | 100% |
|---|
| Cost (USD) | 1749 |
|---|
| Renewal | Does not expire (lifetime). Part of OSCE³ pathway |
|---|
| Skills | white_box_web_testing, source_code_review, authentication_bypass, sql_injection_advanced, custom_exploit_development, script_automation, advanced_web_exploitation |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap