Skip to content
Exploit Labs
WEB-300 · OSWE · Attack · Advanced

WEB-300: Advanced Web Attacks and Exploitation - on the way to OSWE.

WEB-300 is the whitebox advanced course (OSWE): source review with an attacker mindset, authentication bypasses, and building your own exploit chains up to remote code execution in real applications.

OSWE certification badge by OffSec
See licences & pricingAsk for guidanceOfficial OffSec course pageOne-pager (PDF)
Certification
OSWE - OffSec Web Expert
Level
Advanced
Discipline
Attack
Audience
Teams and individuals

Who this course is for

Experienced web testers and application security engineers with source access.

Not the right course yet if

  • -You cannot read someone else's code
  • -Black-box web is still new - start with WEB-200
What you can do afterwards
  • →Review large codebases specifically for exploitable flaws
  • →Write and automate your own exploits
  • →Evidence attack chains from a line of code to RCE
Prerequisites
  • ·Confident web testing experience, ideally OSWA level
  • ·Reading and writing code in at least one language
  • ·Patience for debugging

Not sure whether you meet them? We run a short placement conversation before you buy.

Course content (official scope)

What WEB-300 covers.

  • Source review with an attacker mindset
  • Authentication bypasses
  • Deserialisation and type juggling

Course content, labs and the OSWE exam are provided by OffSec. Precedence always sits with the official course description. This page reviewed: 2026-08-12.

Labs and format

Labs with complete applications including source code, plus a challenge lab for exam preparation.

Exam and credential

48-hour practical exam with a report. Passing awards the OSWE certification.

Buy a licence

The packages that include WEB-300.

Prices in EUR, net, plus statutory VAT. Invoiced through a German entity. Your course is pre-selected at checkout.

Course + Cert Bundle
€1,545

You have a focused block of time and want to sit the exam soon.

  • ▸ 90 days of course access including labs
  • ▸ 1 exam attempt
  • ▸ Exactly this course
Learn One
€2,425

Study alongside a job, without lab time pressure.

  • ▸ 365 days of course access including labs
  • ▸ 2 exam attempts
  • ▸ Proving Grounds Practice, KLCP and OSWP included
Learn Enterprise
€5,500/ seat / year

Several people in a team, with evidenced progression.

  • ▸ The full OffSec catalogue
  • ▸ Learning paths and reporting
  • ▸ Reassignable from 5 seats
Request a team quote
What Exploit Labs adds
  • +A review of your own application as the practical case
  • +Handover into an application pentest engagement where internal capacity is missing

For security teams

Multiple people, role paths, reporting and procurement run through OffSec Learn Enterprise.

See Learn Enterprise

Team capability development

Badges, learning paths and evidence across attack, defend, build and govern.

See the capability map
Where it leads next

Other hackers also bought ... ;)

EXP-301 · OSED
Windows User Mode Exploit Development

Testers and reverse engineers who want to develop Windows exploits themselves.

Frequently asked

Not sure whether WEB-300 is the right course?

We run a short placement conversation: background, study time, goal. Then we recommend a course and package - even when it is the cheaper one.

Request a placement call Compare all courses
Other OffSec courses
SEC-100 · OSCC-SECPEN-103 · KLCPPEN-200 · OSCPPEN-210 · OSWPWEB-200 · OSWASOC-200 · OSDAIR-200 · OSIRTH-200 · OSTHSJD-100 · OSCC-SJDPEN-300 · OSEPEXP-301 · OSEDEXP-401 · OSEEAI-300 · OSAITraining overview
Keep reading

From training to the engagement: our testing services