eWPT study plan
eWPT · Give each week a clear focus.
8 weeks · About 6 hours per week
Web Application Penetration Testing & Web Application Reconnaissance and Enumeration
Map the OWASP Testing Guide v4.2 and WSTG categories to the four exam domains so you can state which methodology section covers each test
Set up an isolated lab (proxy such as Burp or ZAP, a deliberately vulnerable target app, and a notes vault) and confirm you can intercept, replay, and log traffic end to end
Write a personal engagement checklist covering scoping, rules of engagement, authorization, and safe-testing boundaries for a web pentest
Practice reading and annotating HTTP requests and responses until you can identify method, headers, cookies, tokens, and encoding without hesitation
Your checkpoint
A one-page methodology map linking WSTG categories to the four domains, plus a working lab with 10 captured-and-annotated request/response pairs.
Web Application Reconnaissance and Enumeration
Enumerate subdomains, virtual hosts, and DNS records on a lab target using both passive sources and active resolution
Discover content and hidden paths with directory/file brute-forcing and compare wordlist strategies for efficiency
Fingerprint web servers, frameworks, languages, and CMS versions from headers, error pages, and static assets
Identify users, emails, and technology hints through search-engine and public-source techniques against a controlled target
Your checkpoint
A reconnaissance report for one lab target listing subdomains, vhosts, discovered paths, and identified technologies with the evidence that revealed each.
Web Application Reconnaissance and Enumeration & Web Application Vulnerability Identification and Exploitation
Crawl and map an application's attack surface manually and with an automated spider, then reconcile the two maps
Test authentication and session handling: login flows, password policy, session fixation, cookie attributes, and logout behavior
Test access control by attempting horizontal and vertical privilege escalation across roles you create in the lab
Enumerate and interpret API endpoints, parameters, and data formats to build a parameter inventory
Your checkpoint
An attack-surface map and parameter inventory for the lab app, annotated with at least five access-control or session findings and their reproduction steps.
Web Application Vulnerability Identification and Exploitation
Identify and confirm injection flaws (SQL injection, command injection, and template injection) using detection then exploitation steps
Test for cross-site scripting across reflected, stored, and DOM contexts and explain context-appropriate encoding
Test file handling flaws including path traversal, unrestricted upload, and local/remote file inclusion
Distinguish server-side request forgery and XML external entity conditions and demonstrate safe proof-of-concept payloads
Your checkpoint
A vulnerability notebook with one confirmed, reproducible proof of concept per injection and file-handling class, each with request, payload, and impact statement.
Web Application Vulnerability Identification and Exploitation & Web Application Exploitation and Reporting
Exploit confirmed flaws to demonstrate real impact, such as data extraction, authentication bypass, or controlled command execution, within lab scope only
Chain two or more lower-severity issues into a higher-impact attack path and document the chain
Apply a consistent severity rating using CVSS and justify each score with the specific metric values
Practice safe exploitation boundaries: stop conditions, data handling, and avoiding service disruption
Your checkpoint
A chained-exploitation write-up showing at least one multi-step attack path with CVSS-scored findings and documented stop conditions.
Web Application Exploitation and Reporting
Write findings in a consistent template with title, severity, affected asset, reproduction steps, evidence, impact, and remediation
Produce remediation guidance that is specific and actionable rather than generic advice
Draft an executive summary that communicates risk to a non-technical reader in under one page
Structure a full report with scope, methodology, timeline, findings, and appendices
Your checkpoint
A complete mock penetration test report for the lab target, including executive summary, at least six templated findings, and remediation for each.
Web Application Penetration Testing & Web Application Exploitation and Reporting
Rehearse explaining methodology and findings verbally as you would in a client debrief
Review and tighten your notes so every finding is reproducible from the report alone
Identify weak areas from your own notebook and re-test those vulnerability classes until you can confirm them reliably
Practice scoping a new target quickly and producing a test plan within a fixed time budget
Your checkpoint
A recorded 10-minute debrief walkthrough of your report plus a prioritized list of your three weakest areas with a re-test log.
Web Application Penetration Testing & Web Application Reconnaissance and Enumeration & Web Application Vulnerability Identification and Exploitation & Web Application Exploitation and Reporting
Run a timed end-to-end assessment on a fresh lab target covering recon, identification, exploitation, and reporting
Complete a full report from that assessment within a strict time budget
Review all four domains against your notes and close remaining gaps with targeted practice
Finalize a reusable checklist and report template you can apply under exam time pressure
Your checkpoint
A timed full-cycle assessment with a finished report and a final reusable checklist and template.
Milestones
Week 2: You can independently enumerate a target's subdomains, paths, and technologies and explain the evidence for each discovery.
Week 4: You can confirm at least one injection, one XSS, and one file-handling flaw with reproducible proof-of-concept requests.
Week 6: You can convert raw findings into a structured report with CVSS scores and specific remediation.
Week 8: You complete a timed end-to-end assessment and deliver a full report within the time budget.