There are already many reviews and stories about other people’s experiences with the OSWE exam from OffSec. I am also not the first person to write about this. However, I still want to write down my own experience here, one that I went through two exam attempts only because of a trivial mistake in the first exam.

Since I had resigned from the company I previously worked for and was still unemployed, I used the time to focus on studying the OSWE certification material while also taking the exam while waiting for replies to my job applications.

As context, to pass this OSWE certification exam I had to:

• Get a total of 85 points. (the details of the points and how many target machines there are will be explained during the exam)
• Submit every flag to the exam control panel.
• Document every step taken in a report document in detail and to a professional standard.
• Create an exploit code that is fully automated and requires no user interaction at all.

Read more here

First Exam

The exam started at 3 PM and was conducted for almost 2 days (47 hours 45 minutes), and after that I was given 1 day after the exam ended to write the report document of the exam results according to the predetermined format.

The objectives for getting points in this exam were:

• 2 target machines with a total of 50 points for each machine, with the point breakdown for each machine:
  • 35 points if you successfully bypass authentication (gain web administrator access).
  • 15 points if you successfully perform remote code execution (RCE).

In my first exam, I felt the initial session went quite well. I managed to gain web administrator access on one of the machines in only about 1 hour since the exam started, but after that I began to fall into a very exhausting rabbit hole. A rabbit hole that felt very convincing. The details were quite tempting — there were clues that seemed strong, there were results that looked plausible, and everything made me think, “wow, this might indeed be the right path.”

In the end I got stuck on just that one feature for hours. Not just a few hours, but up to 12 hours hahaha. I spent a long time chasing one particular feature that I thought was certainly the key. After that I tried to rest and shifted to the other machine because I was fed up with being trapped in the rabbit hole, and sure enough, I finally managed to gain web administrator access on the other machine.

Time passed and we were entering the final few hours before the exam would end. Coincidentally, at that point I already had quite good progress and had even reached 85 points (gaining web administrator access on 2 machines and getting RCE on only one of the machines). I was very confident this was enough to pass the exam because the minimum score required to pass is 85 points. With about 2 hours remaining, I tried to collect as many and as complete screenshots of code snippets as possible, as well as screenshots of the exploit execution results, as evidence to be included in the report document later.

After the exam time was over, I immediately went to bed to rest because this exam is very draining of energy and mind. After resting enough, I continued writing the report document that I had drafted during the exam earlier to be submitted to OffSec.

3 days passed after I submitted the report document and I received an email that left me quite puzzled because I did not pass the exam. The email content was as follows.

Since I was already confident that I had previously obtained 85 points, I finally tried to appeal to OffSec, and after a re-evaluation of the exam results and a lengthy discussion whose process even took more than 1 month, I finally got the details of why I was not considered to have obtained 85 points.

The only problem was in my exploit script, which had one small but fatal mistake. Because of that mistake, the exploit I submitted was not considered valid on one of the machines, and the points given had to be reduced — or I received no points at all — which made me fail to cross the passing threshold. With an open heart, I accepted that result and decided to retake the exam, which required paying about $249 (approximately Rp 4.4 million according to the exchange rate at the time this article was written).

I can say that the dispute process was quite brutal mentally. I had worked hard for almost 2 days and had already reached a sufficient score, but one small mistake in the script could collapse all the progress I had built. This made me realize that at this level of certification exam, one small mistake can have a very big impact.

Second Exam (Retake)

2 months after the first exam, with the reality that I did not pass, I tried to buy the retake and immediately scheduled a second exam in a very prepared condition. Initially I had a principle not to be too tempted to chase every possibility anymore. I focused more on the objective itself and tried not to get stuck on one thing for too long.

Fortunately, in my retake this time, I got the same set of machines and objectives as the first exam. This was very helpful because I already had prior context and didn’t need to repeat from scratch. I could continue from the existing progress and fix the previous mistake.

In the end, the second exam went more calmly and the result was far more satisfying. I was able to fix the mistake that happened in the first exam and also managed to complete the entire objective given, with points that should have been counted as 100 points in only about 4 hours since the second exam started. After I updated the report document and submitted it, 1 day after I submitted the report document I finally received my passing email.

This is the certificate given by OffSec as a sign that I successfully completed the OSWE exam and the Advanced Web Attacks and Exploitation material. The certificate can also be viewed on the official website here

Lesson Learned

A Small Mistake with a Big Impact

One of the things I remember most from this experience is how one mistake can truly change the exam outcome.

Not only about the exploit script. In OSWE, it is very easy to feel “this is enough” when in fact there is still one thing that hasn’t been checked properly. It could be a typo, a wrong parameter, or an edge case that hasn’t been thought through. I myself learned that at this level, the final step is truly crucial.

From this experience, in the second exam, every time I made a small change to the exploit script, I always tried to revert the machine and rerun it, so I tried to make sure that:

• understand well the name or category of the vulnerability found (for example: code injection with command injection, SSTI with SSRF, local file inclusion with path traversal, and so on)
• my exploit script can truly run in a single attempt
• all variables in the exploit script match the target
• avoid changes that overhaul the content of the exploit script too much
• and what I apply truly comes from the root cause I understand on the target

Previously I believed I could complete this well in the first exam, but in the end I was made to truly believe that in the OSWE exam, “I’m sure” is not enough — it turns out you need to verify repeatedly. Check again, check once more, then check again. Sometimes one keyword, one flag, or one small line of code can make all the paths you have arranged become invalid. In the world of exploitation and exploit development, everything feels very technical and detailed.

Challenge Labs Are Very Helpful

One of the things I found very helpful is the challenge labs. I did not only learn from problems similar to the exam, but also from the way of thinking needed to face unexpected situations.

Challenge labs helped me build very important habits, namely:

• learning to see patterns
• doing structured analysis
• not being too quickly satisfied with one result
• re-checking the steps already taken
• staying focused when there is a “click” in the mind pointing to the wrong path

If I judge from personal experience, challenge labs are not just technical practice, but also psychological practice. You learn how to face frustration when progress doesn’t go as you expect. And that is very important, especially because the OSWE exam is not only about exploit development ability, but also about mental endurance.

The Tricky Rabbit Hole

For me, the rabbit hole is one of the most exhausting and most “killing” aspects of the OSWE exam.

I was once stuck for 12 hours on one particular feature just because everything felt so convincing. I wasn’t being lazy or unfocused — on the contrary, I was very focused. But being too deeply focused on one thing can be dangerous when it isn’t actually going as expected.

I started thinking, “the vulnerability must be here,” or “this feels a bit off, it should work like this here,” then I went into deeper and deeper detail. On one hand, that is indeed part of the security research process. On the other hand, without control, it can turn into a very fatal waste of time.

I came to understand why OffSec level 300 exams are given almost 2 full days: because it is often not just about technical ability, but also the ability to stay calm when everything seems to point in the wrong direction. There are many moments where we feel we are already close, but it is only an illusion.

Key Points

From my experience, besides many things I applied from other people’s experiences out there, there are a few additional lessons that might also be applicable to you:

• verify repeatedly
• don’t spend too long diving into one thing
• challenge labs are very important

Closing

I want to thank the company I previously worked for, Seclab Indonesia, which facilitated me in taking this OSWE certification and also the previous OSCP certification. The support and opportunities given by the company mean a lot to me. This is not just an experience to add a certificate to my profile, but also a very useful experience for my learning process and self-development going forward.

I also want to thank everyone who has helped me in my learning process, both directly and indirectly.

I hope my experience can provide a bit of enlightenment, a reminder, or even inspiration for those of you who are on your way to the OSWE exam or similar certifications.

This is day 7 of 100 days of writing.