Personal update

It has been more than a year since my last post, and a lot has changed since then. I started my first professional penetration testing position, continued to upskill in offensive security, and made some contributions to the open-source offensive tooling community (Metasploit, evil-winrm.py).

Reflections after a year of professional penetration testing

After earning the CWES certification around May 2025, I felt I had reached a level where I could bring value to customers as a penetration testing consultant. I started applying to every penetration testing position I could find on both common and less common hiring platforms, including LinkedIn, Hipo, Indeed, and BestJobs, as well as directly through company websites I found on Google. After around two months of searching, I was fortunate enough to receive an offer to start work as a consultant. Since then, I have taken part in various engagements, most commonly black-box and white-box web application assessments, external and internal infrastructure assessments, mobile application assessments, and occasionally cloud assessments.

For me, the biggest difference between simulated labs and real engagements is time management. An external network engagement may have up to 500 different domains in scope with a very brief testing window, so figuring out how to prioritize them is essential. Here, I would say CPTS prepared me well, with one of the very first modules covering how to manage real engagements with tools such as Gowitness and where to focus your efforts. In comparison, a simulated lab will have nowhere near that amount of attack surface or the time crunch that comes with it.

As for which is more difficult to test, it’s hard to draw a comparison, as some clients have a more mature security posture than others. Overall, though, the creative, out-of-the-box thinking developed on platforms like HTB, THM, and Proving Grounds comes in very useful during real engagements as well, especially when you need to chain lower-severity vulnerabilities to demonstrate maximum impact.

Of the engagement types I have done so far, external infrastructure assessments are my favorite, as they simulate how an external threat actor might poke at a company from the outside. White-box web application testing is growing on me the most, but more on that later.

Just one more cert

A year passed, several more certifications acquired. I am a firm believer that continuous upskilling is essential for anyone who wants to excel in this field. Personally, I prefer to do so through certifications, as they provide structure, learning material, and an exam to work toward that tests what I’ve learned. The credential itself mainly serves as a bonus. With web application penetration testing still making up most of the consulting market, it only made sense to continue focusing most of my upskilling on this area.

BSCP

Training

Among web certifications, BSCP covers by far the widest range of attack types, with advanced coverage of most. For me, it had the best client-side attack labs and provided a very solid introduction to infrastructure-based web attacks such as HTTP request smuggling and web cache poisoning. The business logic labs also helped me develop the reasoning needed to identify these more subtle flaws in real web applications. In my opinion, it does have some downsides, however:

  • Some sections are not very deep. For instance, the insecure deserialization section felt too brief for such a complex subject.
  • The training is not very well structured. It feels more like a collection of well-done sections than a progressive learning path toward a certification.

Preparation

There are already plenty of well-written blog posts about studying for and passing the certification, so I don’t have much to add to what has already been said. Personally, I studied the PortSwigger vulnerability sections alongside courses from Rana Khalil’s Academy, which really helped me. For each topic, I would complete Rana’s course, then move on to the official PortSwigger resource.

Additionally, I would advise anyone planning to take this exam to have CWES or equivalent knowledge first to establish a proper foundation. BSCP already assumes you have a base of black-box penetration testing knowledge, while CWES teaches everything from the ground up. Besides that and the practice exams, I did Mystery Labs until I could consistently solve them quickly. There is also a certification track on WebVerse, which I have not done, but I have heard good things about the platform.

The exam

With a four-hour time limit, this was likely the exam where time management mattered the most. I would advise anyone taking it to have well-structured notes and all external resources bookmarked and ready before starting. Once a vulnerability is found, the notes should cover the exploitation steps, as there is not much time to figure them out during the exam. Personally, I needed two attempts in the same day to pass, so starting early in the morning on a Saturday or Sunday may be a good idea for those planning to do the same.

OSCP

Training

I think the OSCP course teaches a skill that is very useful in external engagements and in general: facing the unknown and making sense of it. During an external engagement, I often come across an open-source web application or a network protocol I have never seen or tested before. After this certification, I had a much better idea of how to approach this sort of challenge: how to quickly understand it from documentation, identify its version, probe it for common misconfigurations, determine whether an exploit might work, and adapt exploits for restrictive environments.

Additionally, the course had the best and most stable labs of any certification I have done, with one containing 20+ machines, all dedicated to a single user, which is unheard of among cybersecurity training providers.

Preparation

For the Active Directory portion, I was already at a pretty good level thanks to my previous training, largely from the CPTS path and HTB machines. For the standalones, however, I was far from prepared, as OffSec has a particular “style” of machines. Some may call it “guessy,” which might be a fair assessment, but this trait is also what makes OSCP so good at teaching you to deal with the unknown.

Besides completing the course and all the challenge labs, I also did all the Proving Grounds and VulnLab machines from LainKusanagi’s list, along with most of the easy and medium AD machines on HTB. Other learners have also been recommending the labs on HackSmarter, which were not available when I was preparing.

The exam

I was very paranoid before starting the exam, as this was my first proctored penetration testing exam. The hardware test beforehand helped though, as it confirmed that my setup, including the camera, met the exam requirements.

As for the exam itself, I would say it was challenging but fair. I needed 10 hours to reach the required 70 points to pass and four more hours to get an additional 20 points. After spending a few more hours trying to get the remaining 10 points without success, I decided to use the remaining time to write the report instead.

In my opinion, this is one of the most overlooked tactics for the exam. Instead of going to sleep and writing the report during its dedicated 24-hour block, I wrote it during the exam’s 24-hour block. That way, I still had access to the live testing environment in case I had forgotten any screenshots or other evidence required for the report. However, lack of sleep can lead to mistakes and lower-quality writing. After completing the report around the 22-hour mark, I went to sleep and reviewed it after waking up rather than submitting it straight away.

CWEE

Training

What’s unique about HTB’s CWEE is that it teaches both black-box and white-box penetration testing at an advanced level, whereas most other web certifications focus on one or the other. The black-box half took most of the vulnerability classes I already knew, sprinkled in a few new ones, and took both their detection and exploitation to the next level. Of the black-box modules, I enjoyed “Advanced XSS and CSRF Exploitation” the most, as it showed some really unique ways to demonstrate maximum impact, such as chaining XSS with exploits for LFI, command injection, and SQL injection.

As someone new to white-box penetration testing, I found the second half of the course excellent. By the end, I had developed a solid methodology for tackling white-box web application scenarios regardless of the framework. The main drawback for me was the lack of coverage of Java insecure deserialization.

Preparation

In my opinion, there are four mandatory pillars to cover before starting this path:

  1. Web vulnerability knowledge

    CWES, BSCP, or both, or an equivalent level of knowledge.

  2. Coding

    For those completely new to coding in Python, I would recommend boot.dev or “100 Days of Python” on Udemy. I would say boot.dev is better here, as it focuses on backend development, the very area CWEE tests. My boot.dev profile lists all the courses I did on the platform beforehand.

  3. Web Application Familiarity

    After getting familiar with coding, it’s a good idea to build a simple web app with an accessible framework such as Flask to understand how web application code is structured. An example would be a to-do app built with Flask and SQLAlchemy.

  4. Web application exploit development

    Once you are familiar with coding and basic web application structure, Rana Khalil’s Academy provides a very good introduction to web application exploit development and explains how the code is built, typically in the server-side topic courses. I then started writing end-to-end automated exploits for labs on whichever platform I had a subscription to at the time. That was Proving Grounds for a while, followed by HTB web challenges, until I felt comfortable.

For exam preparation, I only did the path itself, along with the CWES and CWEE tracks on the HTB Labs platform.

The exam

This was the hardest exam I have taken to date. Within the allotted 10 days, it tested my knowledge of all the modules through some of the most intricate chains I have seen so far. A large portion of my exam time went into preparing patches for each vulnerability I found. I tested these in a replica environment for each application to verify that they fixed the vulnerabilities without breaking normal functionality.

PenTest+

Not much to add here, since I was already pretty well prepared thanks to my experience and previous certifications. One of our customers required two consultants to have the PenTest+ certification. Since only one of my colleagues had it, I decided to take on the challenge myself. For preparation, I only did three practice exams from Jason Dion’s six-practice-exam set on Udemy over two days, then took and passed the exam.

What comes next

Next, I will focus on upskilling in mobile penetration testing through both on-the-job training and the Android Penetration Testing path on HTB. What I find interesting is that this is one of the most requested penetration testing services, yet one of the areas receiving the least attention among professionals and cybersecurity training platforms. While I have not been able to find an answer as to why, I believe it’s because it sits at the intersection of several disciplines: reverse engineering, API testing, and Android and iOS platform internals. This makes it one of the most advanced penetration testing disciplines. Besides that, I will soon tackle the final boss of web penetration testing certs, OSWE.