Web application testing is learned by finding real flaws in running applications, and the OffSec Web Assessor (OSWA) certification measures whether you can do that across five targets in a single day and then write it up so someone else can reproduce it. OSWA is the certification for OffSec's WEB-200 course, Web Attacks with Kali Linux. This guide sets out what OffSec publishes about it: the exam structure, scoring and report rules, permitted and restricted tools, purchase options and the fact that OSWA does not expire. It adds a preparation plan and shows where OSWA sits on a web security career path. It is written for penetration testers moving into web work, developers who want to test like an assessor, and managers planning web testing skills. Facts are from offsec.com and OffSec's help centre, checked 8 November 2026; confirm fees and exam rules there before you buy.
This is an independent guide from NHI Mgmt Group, based on OffSec's public documentation as of November 2026. It is not sponsored or reviewed by OffSec. Product features change, so confirm settings against OffSec's current documentation.
Key takeaways
- It is a hands-on, black box web exam. Five independent targets, each with a local.txt and a proof.txt; the goal on each is an authenticated administrator session and then the proof file from the server.
- Points and pass mark are clear. Each flag is worth 10 points, 100 in total, and you need 70 to pass.
- The clock is long. 23 hours and 45 minutes for the exam, then 24 hours to submit a professional report.
- Tools are allowed, with limits. sqlmap, Burp Suite (Community or Professional), Nmap, Nikto and others are permitted; mass vulnerability scanners, automatic exploitation, spoofing and LLM chatbots are not.
- It does not expire. OffSec states on the WEB-200 page that OSWA has no expiry date, so there is no renewal fee or CPE cycle to manage.
Who the certification is for
OffSec describes WEB-200 as a 200-level course with 231 hours of content for security professionals who want to improve web application testing skills, and for people with web development knowledge and familiarity with Linux. In practice that means:
- Penetration testers whose work is shifting from infrastructure to web applications.
- Application security engineers who triage findings and want to reproduce them confidently.
- Web developers who want to understand how their code is attacked.
- Bug bounty hunters who want structured coverage of the core vulnerability classes. See the Bug Bounty Hunter Career guide.
Less suited (our judgement): people with no web or Linux background, who should take OffSec's Web Application Assessment Essentials learning path first, and testers who already work from source code and want a white box credential. OffSec's 300-level web course covers that ground; see the OSEP and OSWE Certification Guide.
Exam format and domains
Format
| Item | OSWA (OffSec, checked 8 November 2026) |
|---|---|
| Duration | 23 hours 45 minutes |
| Targets | 5 independent targets, each with local.txt and proof.txt |
| Objective per target | Gain an authenticated administrator session, then retrieve proof.txt from the server |
| Flag locations | local.txt is in the web application's administration section; proof.txt is usually in the root directory or a user or process home directory |
| Scoring | 10 points per flag, 100 maximum; flags submitted in the Exam Control Panel, which does not confirm correctness |
| Pass mark | 70 points |
| Reverts | Up to 24 target reverts and one reset |
| Connection | Kali Linux over OpenVPN; connection pack emailed at the start time |
| Proctoring | All exams proctored; all activity on the host running the proctoring application |
| Resources | Open book (notes, online resources, OffSec Learning Platform); no LLMs or AI chatbots; no help from others |
| Report deadline | 24 hours after the exam ends |
| Results | Pass or fail by email within 10 business days; no scores or solutions |
Tools: permitted and restricted
| Permitted (named in the exam guide) | Restricted |
|---|---|
| Nmap and its scripts, Nikto, Burp Suite Community or Professional (plugins allowed if they do nothing restricted), DirBuster, sqlmap, Tplmap, msfvenom, ysoserial | Spoofing (IP, ARP, DNS, NBNS), commercial tools or services, automatic exploitation tools, mass vulnerability scanners, downloading files or source code from the exam environment, LLMs and AI chatbots |
Any SQL injection tool or Burp plugin you use must be documented in the report. Tools with built-in AI features, such as note-taking apps, do not need to be disabled, but you must not use AI chatbots. See Burp Suite for Authorised Web Testing Guide.
Skills the exam exercises
OffSec does not publish weighted domains. WEB-200 has 16 modules and 9 challenge labs; the course page names these vulnerability classes and skills (grouping ours):
- Reconnaissance and enumeration: mapping the application, sourcing or generating wordlists.
- Client-side flaws: cross-site scripting of several types, CSRF and CORS misconfiguration. See the Web Application Attacks Guide.
- Injection: SQL injection by fuzzing, sqlmap and manual methods, and server-side template injection. See the SQL Injection Prevention Guide.
- Server-side requests and parsing: SSRF (with two real-world case studies) and XXE. See the SSRF Prevention Guide.
- Proxy craft: Burp Suite Repeater, Comparer, Intruder and Decoder.
Where identity fits: the exam goal on every target is an authenticated administrator session, so authentication and session handling sit at the centre of the work. Practise finding paths from an anonymous user to an admin session, and write remediation that fixes the access control, not just the injection point. See the OWASP Top 10 A01 Guide and the OWASP Top 10 A07 Guide.
Prerequisites and experience
OffSec states no formal prerequisites but strongly recommends:
- Web development basics: HTML, CSS and JavaScript.
- Networking fundamentals.
- Linux basics.
It points learners who need these to its Web Application Assessment Essentials learning path. Realistic readiness (our judgement): you can read and modify a short JavaScript or Python script, explain how cookies and sessions work, use an intercepting proxy fluently, and have tested a few deliberately vulnerable applications in a lab you are authorised to use.
Preparation plan
- Choose the purchase option: the 90-day bundle suits someone who can study most days; Learn One gives a year and two attempts.
- Work through WEB-200 (weeks 1 to 8): complete the 16 modules, keeping your own notes and a payload-free checklist per vulnerability class (what to look for, how to confirm, what evidence to capture).
- Challenge labs (weeks 8 to 11): treat each of the 9 challenge labs as an exam target: admin session first, then the server, then write it up.
- Report practice (alongside): write every lab in the OSWA report template with steps, commands, console output and screenshots of the proxy and browser showing each flag.
- Timed rehearsal (week 12): attempt several labs in one long session, with planned sleep and breaks, to rehearse pacing over nearly 24 hours.
- Environment check (week before): test the proctoring tool, your Kali VM and OpenVPN, and rehearse building the report archive and checking its MD5 hash.
- Exam day: enumerate all five targets early, bank easy flags, and capture evidence the moment you find it.
If you fall short: if your report scored insufficient points you can request feedback by email; OffSec responds within 10 business days. A cooling-off period applies between attempts; check OffSec's retake policy for the current length.
Small vs large organisations: a small team may put one tester through the bundle and use their notes as internal guidance. Larger teams can use OffSec's team pricing and adopt the OSWA report structure as a house standard for web findings. See the Web Application Security Testing Guide.
Report requirements
| Element | OffSec requirement | Practical implication |
|---|---|---|
| Content | All steps, commands and console output so a technically competent reader can reproduce each attack; scripts and proofs of concept as text in the PDF | Write as you go; reconstructing later costs points |
| Flag evidence | Web UI flags: screenshots of proxy and browser showing the value; shell flags: screenshot of the file contents from its original location | Take both screenshots before moving on |
| Strictness | Missing screenshots or information cannot be added later; poor documentation can reduce or zero points | A flag without evidence may score nothing |
| Format | PDF named OSWA-OS-XXXXX-Exam-Report.pdf in an unencrypted .7z of the same name, case-sensitive, under 200MB; upload and compare MD5 | Rehearse the archive and upload steps |
Black box mindset: the exam gives you running applications, not source code. Our recommendation is to practise building a mental model of each application from its behaviour alone: list every input, every role and every server-side feature such as file fetching, templating or XML parsing, then test each against the vulnerability classes above. That habit is also what makes a web assessor useful on real engagements, where scope and time are fixed.
Measuring readiness
- Lab coverage: all 9 challenge labs completed and written up.
- Admin session rate: in timed practice, admin access on at least four of five targets.
- Report time: a complete report produced well inside 24 hours.
- Evidence completeness: every practice flag has both required screenshots.
Cost, renewal and continuing education
| Option (OffSec, USD, checked 8 November 2026) | Price | Includes |
|---|---|---|
| Course and Cert Bundle | $1,749 one-time | 90 days of access to one 200 or 300-level course, labs, one exam attempt |
| Learn One | $2,749 list, shown at $2,199 a year under an anniversary offer; auto-renews unless cancelled | One year of access to one 200 or 300-level course, labs, two exam attempts |
| Teams | Custom pricing | Through OffSec sales; free trial on request |
- Expiry: OSWA does not expire, per OffSec's course page.
- CPE credit: OffSec states the course may qualify for up to 40 (ISC)2 CPE credits, subject to eligibility.
- Keeping skills current (our recommendation): a non-expiring credential still ages. Revisit new web vulnerability classes yearly and log the practice for any other certifications you hold.
Common failure patterns
- Screenshots missing for a found flag: both proxy and browser evidence are required for web UI flags.
- Using a restricted tool: mass scanners, automatic exploitation and spoofing are banned; check the list before exam day.
- Undocumented tools: sqlmap use and Burp plugins must be written up.
- Using an AI chatbot: treated as third-party help under OffSec's policy.
- Poor pacing: stuck for hours on one target while easier flags elsewhere wait.
- Malformed submission: wrong file name, case or archive format, or an upload without MD5 verification.
Where it fits on the career path
| Stage | OffSec credential | Relationship to OSWA |
|---|---|---|
| Foundations | OffSec CyberCore (OSCC) | General security grounding before specialising |
| Web assessor (black box) | OSWA | Find and exploit web flaws from the outside, then report |
| Network penetration tester | OSCP | Broader infrastructure testing that often includes web entry points |
| Web expert (white box) | OSWE | Source code review and exploit chaining at 300 level |
- See OffSec CyberCore (OSCC), the OSCP Certification Guide and the OSEP and OSWE Certification Guide.
- For roles: the Penetration Tester Career Guide.
Practitioner checklist
- Check web development, networking and Linux basics before buying.
- Pick the bundle or Learn One based on study time and attempts needed.
- Complete all 16 modules and 9 challenge labs, writing each up in the report template.
- Learn the permitted and restricted tool lists by heart.
- Rehearse a long, paced session across several targets.
- Capture proxy and browser screenshots for every flag as you find it.
- Test proctoring, OpenVPN, archive naming and MD5 checks beforehand.
- Submit the report within 24 hours in the exact required format.
Standards and references
- OffSec: WEB-200 Web Attacks with Kali Linux (OSWA)
- OffSec Support: OSWA Exam Guide
- OffSec Support: OSWA Exam FAQ
Related NHI Mgmt Group resources: Web Application Security Testing Guide · OSEP and OSWE Certification Guide · Penetration Tester Career Guide · Burp Suite for Authorised Web Testing Guide · Cybersecurity Certifications Guide