PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free HTB CWES Practice Questions

Prepare for the HTB Certified Web Exploitation Specialist (formerly CBBH) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Hack The Box Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

HTB Certified Active Directory Pentesting Expert (CAPE)

Practice Questions

HTB Certified Defensive Security Analyst (CDSA)

Practice Questions

HTB Certified Junior Cybersecurity Associate (CJCA)

Practice Questions

HTB Certified Penetration Testing Specialist (CPTS)

Practice Questions

HTB Certified Web Exploitation Expert (CWEE)

Practice Questions

HTB Certified Wi-Fi Pentesting Expert (CWPE)

Practice Questions
2026 Statistics

Key Facts: HTB CWES Exam

Practical

Exam Format

Hack The Box

7 days

Lab Access Period

Hack The Box

8/10 flags

Passing Requirement

Hack The Box

~$210

Exam Voucher Cost

HTB Academy

3 years

Certification Validity

Hack The Box

5 web apps

Exam Targets

Hack The Box

The HTB CWES (formerly CBBH) from Hack The Box is an advanced practical web exploitation certification. Over a 7-day lab period, candidates must exploit 5 web applications and capture 8 of 10 available flags, then submit a professional penetration testing report. Core technical areas: SQL injection, XSS, SSRF, XXE, LFI/RFI, command injection, file upload vulnerabilities, web API attacks (IDOR, mass assignment, JWT), and vulnerability chaining. Certification is valid 3 years. This practice test covers the theoretical knowledge — the real exam requires live web application exploitation.

Sample HTB CWES Practice Questions

Try these sample questions to test your HTB CWES exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which HTTP header sent by the browser tells the server the full URL of the page that linked to the current request, and is commonly abused to test Referer-based SSRF or origin validation weaknesses?
A.Referer
B.Origin
C.X-Forwarded-For
D.Host
Explanation: The Referer header contains the URL of the linking page and is sent automatically by browsers. Attackers abuse it to bypass Referer-based CSRF protections or trigger SSRF when servers make outbound requests based on its value. Origin is sent in CORS preflight requests, X-Forwarded-For carries proxy IP info, and Host identifies the requested domain.
2In Burp Suite, which tool is used to send a single HTTP request repeatedly with modifications, allowing precise manual testing of individual parameters?
A.Intruder
B.Scanner
C.Repeater
D.Decoder
Explanation: Burp Repeater allows you to manually modify and resend individual HTTP requests and inspect responses in detail. It is the primary tool for validating and exploiting vulnerabilities like SQLi and XSS one payload at a time. Intruder automates fuzzing, Scanner automates vulnerability detection, and Decoder encodes/decodes data.
3A web application appends user input directly to a SQL query: `SELECT * FROM users WHERE id='<input>'`. Which payload causes the application to return all rows by breaking out of the string context?
A.' OR 1=1--
B.UNION SELECT null--
C.'; DROP TABLE users--
D.admin'/*
Explanation: The payload `' OR 1=1--` closes the string with a single quote, adds a condition that is always true (1=1), and comments out the rest of the query. This causes the WHERE clause to match every row. UNION-based payloads require knowing column counts, DROP TABLE is destructive DDL, and admin'/* is a partial comment approach.
4Which SQLMap flag is used to specify the target URL for an injection test?
A.-u
B.-p
C.--dbs
D.--forms
Explanation: SQLMap's `-u` (or `--url`) flag specifies the target URL to test. `-p` specifies a particular parameter to test, `--dbs` enumerates available databases once injection is confirmed, and `--forms` instructs SQLMap to parse and test HTML forms on the page.
5A UNION-based SQL injection attack requires that the injected SELECT statement returns the same number of columns as the original query. Which technique is used to determine the correct column count?
A.ORDER BY incrementing
B.HAVING clause injection
C.Stacked queries
D.Error-based extraction
Explanation: By injecting `ORDER BY 1--`, `ORDER BY 2--`, and so on, an attacker increments the column index until an error occurs, revealing the column count. HAVING clause is used for aggregate filter injection, stacked queries execute additional statements, and error-based extraction uses database error messages to leak data.
6In blind SQL injection, the application returns no data but behaves differently based on query truth. Which subtype uses sleep functions like `SLEEP(5)` to infer results?
A.Error-based injection
B.Boolean-based blind
C.Time-based blind
D.Out-of-band injection
Explanation: Time-based blind SQLi injects sleep functions (e.g., `'; IF(1=1) WAITFOR DELAY '0:0:5'--`) to confirm injections when the response time increases. Boolean-based blind uses conditional true/false responses with no sleep. Error-based reveals data via error messages. Out-of-band sends data via DNS or HTTP to an external server.
7A reflected XSS payload is injected into a search parameter that appears in the HTML body. Which payload is the most basic test to confirm unescaped output?
A.<img src=x onerror=alert(1)>
B.javascript:alert(1)
C.'';!--"<XSS>=&{()}
D.&#x3C;script&#x3E;alert(1)&#x3C;/script&#x3E;
Explanation: The `<img src=x onerror=alert(1)>` payload executes JavaScript via the onerror event handler when the browser fails to load the image src `x`. It works even when `<script>` tags are filtered. The javascript: URI works only in href/src attributes, not in direct HTML injection. HTML entity encoding in the last option would not execute in the browser.
8Stored XSS differs from reflected XSS in that the malicious payload is stored in the application's backend (e.g., database) and executed when other users load the page. Which attack scenario best illustrates stored XSS?
A.Posting a comment containing a script tag that executes for all visitors
B.Injecting a payload into a search box URL that is immediately reflected
C.Using DOM manipulation to redirect after a hash change
D.Encoding a payload in the URL fragment to bypass WAF
Explanation: Stored XSS occurs when the payload is saved server-side (in a database, log file, etc.) and later rendered to other users' browsers. A malicious comment field is the classic example — every visitor who loads the comment section executes the attacker's script. Reflected XSS is tied to the request itself and is not stored.
9In DOM-based XSS, the vulnerability exists entirely in client-side JavaScript. Which of the following is a DOM XSS sink where attacker-controlled data can cause JavaScript execution?
A.document.getElementById()
B.document.cookie
C.innerHTML
D.window.location.hostname
Explanation: innerHTML is a DOM XSS sink because assigning attacker-controlled HTML to it causes the browser to parse and execute any script tags or event handlers in that string. document.getElementById() is a source/selector, document.cookie reads cookie values, and window.location.hostname extracts the hostname from the URL.
10Which Content Security Policy (CSP) directive restricts which origins can serve scripts, directly mitigating reflected and stored XSS?
A.script-src 'self'
B.X-Content-Type-Options: nosniff
C.X-Frame-Options: DENY
D.Strict-Transport-Security
Explanation: The CSP `script-src 'self'` directive tells browsers to only execute scripts from the same origin as the page, blocking attacker-injected scripts from external origins. X-Content-Type-Options prevents MIME-type sniffing, X-Frame-Options prevents clickjacking, and HSTS enforces HTTPS but does not restrict script sources.

About the HTB CWES Exam

The HTB Certified Web Exploitation Specialist (CWES), formerly known as the Certified Bug Bounty Hunter (CBBH), is Hack The Box's advanced practical certification validating web application exploitation skills. The exam requires candidates to attack 5 real web applications in an HTB lab environment over 7 days, capturing at least 8 of 10 flags using techniques including SQLi, XSS, SSRF, XXE, file inclusion, command injection, file upload attacks, and web API exploitation. This practice bank tests the theoretical knowledge underlying the practical exam.

Assessment

Performance-based assessment

Time Limit

7-day practical lab + 24-hour report submission window

Passing Score

8/10 flags + professional report

Exam Fee

Approximately $210 USD (exam voucher) (Hack The Box)

HTB CWES Exam Content Outline

10%

Web Enumeration & Reconnaissance

HTTP fundamentals, Burp Suite proxy setup, web fingerprinting, directory/file fuzzing with Gobuster and ffuf, subdomain and virtual host enumeration, robots.txt analysis, certificate transparency

15%

SQL Injection

In-band (UNION-based, error-based), blind (boolean-based, time-based), out-of-band, and second-order SQLi; SQLMap automation; authentication bypass; database and schema enumeration; WAF bypass

15%

Cross-Site Scripting (XSS)

Reflected, stored, and DOM-based XSS; injection context analysis (HTML body, attribute, JavaScript); CSP and filter bypass; cookie theft; session hijacking; XSS-to-CSRF chaining

15%

File Inclusion & Command Injection

LFI with path traversal, PHP wrappers (php://filter, php://input), log poisoning for RCE; RFI for webshell execution; OS command injection, command separator bypass, $IFS evasion; reverse shells

15%

SSRF & XXE Injection

SSRF targeting internal services and cloud metadata (169.254.169.254); SSRF bypass techniques (DNS rebinding, open redirect); XXE for local file read, SSRF, and out-of-band exfiltration via parameter entities

15%

Web API Attacks

OWASP API Security Top 10; IDOR/BOLA; mass assignment; BFLA; GraphQL introspection and enumeration; REST API testing; JWT attacks (none algorithm, RS256-to-HS256 confusion, weak secret brute-force)

10%

Auth, Session & Business Logic

CSRF attacks and token-based defense; cookie security attributes (HttpOnly, Secure, SameSite); session hijacking; cookie tampering; token enumeration; password reset poisoning via Host header injection; business logic flaws

5%

File Upload & Reporting

Upload filter bypass (extension blacklist, MIME spoofing, double extension, null byte, case sensitivity); webshell deployment; vulnerability chaining; professional pentest report writing with CVSS severity ratings

How to Pass the HTB CWES Exam

What You Need to Know

  • Passing score: 8/10 flags + professional report
  • Assessment: Performance-based assessment
  • Time limit: 7-day practical lab + 24-hour report submission window
  • Exam fee: Approximately $210 USD (exam voucher)

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

HTB CWES Study Tips from Top Performers

1Master Burp Suite inside-out: Proxy, Repeater, Intruder, Decoder, and extensions like Active Scan++ and Autorize
2Practice manual SQL injection before using SQLMap — understanding column-counting, UNION exploitation, and blind detection is essential when tools fail
3Learn XSS in all three injection contexts: HTML body, HTML attribute, and JavaScript string — each requires different break-out techniques
4Study PHP wrappers (php://filter, php://input) for LFI-to-RCE escalation via log poisoning and wrapper chains
5Practice SSRF by targeting 169.254.169.254 cloud metadata and map the escalation path from SSRF to credential theft
6Build a personal methodology checklist: start every target with enumeration, then work through injection classes systematically
7Practice vulnerability chaining: SSRF + XXE, XSS + CSRF, LFI + log poisoning — exam flags often require multi-step exploitation
8Write at least two mock penetration test reports before the exam to practice structuring findings, PoCs, and CVSS ratings
9Complete PortSwigger Web Security Academy labs on SQLi, XSS, SSRF, XXE, and file upload — they directly map to CWES content

Frequently Asked Questions

What is the HTB CWES exam format?

The HTB CWES is a fully practical, hands-on web application penetration test. Candidates receive 7-day access to a lab environment containing 5 vulnerable web applications with 10 flags distributed across them. To pass, you must capture at least 8 flags and submit a professional penetration testing report within 24 hours after the lab period ends. It is not a multiple-choice exam — this practice bank tests the theoretical knowledge underlying the practical skills.

What is the difference between CWES and CBBH?

CWES (Certified Web Exploitation Specialist) is the current name for the certification previously known as CBBH (Certified Bug Bounty Hunter). The core content and practical lab format are the same; Hack The Box rebranded the certification to better reflect its web exploitation focus. If you hold CBBH, you hold the equivalent of CWES. All HTB Academy Bug Bounty Hunter path study materials remain applicable.

What topics does the HTB CWES cover?

CWES covers eight major domains: (1) web enumeration and reconnaissance with Burp Suite and ffuf, (2) SQL injection including blind and UNION-based, (3) XSS in all three contexts, (4) file inclusion (LFI/RFI) and OS command injection, (5) SSRF and XXE injection, (6) web API attacks including IDOR, mass assignment, and JWT attacks, (7) authentication and session attacks including CSRF and cookie manipulation, and (8) file upload bypass techniques and professional reporting.

How do I prepare for the HTB CWES?

Complete HTB Academy's Bug Bounty Hunter learning path (approximately 100+ hours). Focus on each vulnerability module with hands-on practice. Master Burp Suite's Proxy, Repeater, and Intruder. Practice on DVWA, HackTheBox web challenges, and PortSwigger Web Security Academy labs. Study the OWASP WSTG and OWASP API Security Top 10. Practice writing professional penetration testing reports before the exam.

How does CWES compare to eWPT and BSCP?

HTB CWES is at a similar level to INE Security's eWPT (intermediate-advanced practical web cert). BSCP (Burp Suite Certified Practitioner) from PortSwigger is more challenging and advanced, covering topics like deserialization, HTTP request smuggling, and prototype pollution. CWES is a good stepping stone to BSCP. All three are practical lab-based certifications valued by employers for web application security roles.

Is this practice test like the real CWES?

No — this is a multiple-choice knowledge-preparation bank. The real CWES is a fully practical exam where you must actually exploit vulnerable web applications in an HTB lab environment. These questions test the conceptual and technical knowledge underlying the practical skills: how vulnerabilities work, what tools and payloads to use, and what mitigations apply. Use this bank to validate your theoretical understanding, then practice hands-on exploitation in HTB and PortSwigger labs.