eWPT study guide
eWPT · Work through your exam, one topic at a time.
The eWPT (Web Application Penetration Tester) is a cybersecurity certification listed by INE among its cybersecurity certifications, alongside the eJPT, eCPPT, eMAPT, eWPTX and others. INE describes itself as offering a continuous learn-by-doing training model built on hands-on, technically challenging material, and its certification pages sit within a catalogue that also includes digital badging, certification renewal and an online certification verification service. The eWPT is aimed at practitioners who test web applications rather than networks or mobile apps; the related eWPTX sits further up the same web-testing track. Preparation in practice means building real web-testing fluency: mapping an application's attack surface, enumerating content and technology, identifying and confirming injection, authentication, session, access-control and file-handling weaknesses, exploiting them safely, and writing findings that a client can act on. The eWPT study guide has 4 sections and about 1,568 words.
01Web Application Penetration Testing: Methodology, Scope, and HTTP Foundations
This domain tests whether you can run a web application penetration test as a controlled, evidence-driven engagement rather than a bag of payloads. Expect questions on scoping and rules of engagement, black/grey/white-box testing, HTTP and session mechanics, authentication versus authorization, and how to sequence tests so findings are reproducible and in scope.
392 words, about 2 min02Web Application Reconnaissance and Enumeration: Mapping the Attack Surface
This domain tests how you discover and map a web application's attack surface without wasting requests. Reconnaissance is passive collection; enumeration is active discovery of hosts, paths, parameters, technologies, and APIs.
383 words, about 2 min03Web Application Vulnerability Identification and Exploitation: Context, Confirmation, Impact
This domain tests whether you can identify a vulnerability class, choose a payload that fits the exact context, and confirm exploitability with evidence. You need working knowledge of injection, cross-site scripting, SSRF, XXE, file upload, path traversal, deserialization, CSRF, and business-logic flaws.
409 words, about 2 min04Web Application Exploitation and Reporting: Evidence, Impact, and Remediation
This domain tests what happens after a vulnerability is confirmed: controlled exploitation within scope, evidence collection, impact analysis, and a report that a technical and non-technical reader can act on. The exam values reproducibility, professional handling of sensitive data, and clear remediation over dramatic payloads.
384 words, about 2 min