I85PREP
⌘ K
eWPT study materials
eWPT study resources

eWPT: Web Application Penetration Testing: Methodology, Scope, and HTTP Foundations

eWPT · Work through your exam, one topic at a time.

All guide sections

Web Application Penetration Testing: Methodology, Scope, and HTTP Foundations

This domain tests whether you can run a web application penetration test as a controlled, evidence-driven engagement rather than a bag of payloads. Expect questions on scoping and rules of engagement, black/grey/white-box testing, HTTP and session mechanics, authentication versus authorization, and how to sequence tests so findings are reproducible and in scope.

Core rules and concepts

  • Define scope, targets, test windows, allowed techniques, and emergency contacts before sending traffic. A finding outside scope is not a finding; stop and document.
  • Map the application: entry points, roles, trust boundaries, state-changing requests, and APIs. Test each role and each object reference.
  • Know HTTP fundamentals: methods, status codes, headers such as Host, Origin, Referer, Authorization and Cookie, content types, and redirect behaviour. Distinguish 401 from 403: 401 means unauthenticated; 403 means authenticated but forbidden, so still test for bypass.
  • Session handling: token entropy, cookie flags (Secure, HttpOnly, SameSite), fixation, rotation on login and logout, and CSRF.
  • Authentication proves identity; authorization decides permitted actions. Broken access control often hides in APIs and direct object references.

Worked example

A request GET /api/v1/invoices/1042 with Cookie: session=... returns an invoice belonging to another user. The parameter is an object identifier, the response is 200, and the body contains another tenant's data. This is not a login bypass; it is a horizontal authorization failure (IDOR). Confirm by replaying with a second account's session and comparing responses, then test sequential IDs and UUIDs and check whether the server enforces tenant scoping. Report the exact request, both identities, and the data exposed.

Traps that cost marks

  • Treating a 403 or a hidden button as secure without testing forced browsing and method changes.
  • Confusing authentication with authorization; a valid session does not mean correct object-level checks.
  • Missing state transitions: password reset, MFA enrolment, invite acceptance, role change.
  • Not recording the original request and response; without evidence the finding is unverifiable.
  • Testing only the UI. APIs and mobile-facing endpoints often expose the same functions with weaker checks.