eWPTX study materials
eWPTX study resources

eWPTX case studies

eWPTX · Put your knowledge to work in context.

The Web Application Penetration Tester eXtreme (eWPTX) is described by its provider, INE Security, as its most advanced penetration testing certification. Candidates demonstrate their penetration skills through a rigorous simulation of real-world pentesting, and students who obtain their eWPTXv2 exam prove their expert pentesting abilities. It sits above the entry-level eJPT and the intermediate eWPT in INE's cybersecurity certification lineup, so it is aimed at experienced web application penetration testers who already handle application-level testing comfortably and want to evidence deeper offensive skill against demanding, realistic targets rather than answer knowledge questions. Because the exam is a hands-on simulation, preparation should center on practicing exploitation end to end - enumeration, vulnerability discovery, exploitation, and reporting - against lab environments rather than memorizing theory. The eWPTX case studies are 5 cases and about 2,679 words.

1

The Blind SSRF That Only Speaks DNS

During a white-box review of a Node.js invoice app you find an endpoint POST /api/invoices/preview that fetches a user-supplied templateUrl . The fetch helper blocks RFC1918 literals and localhost by regex on the raw string, then calls axios.get(url, {maxRedirects: 0}) .

398 words, about 2 min
2

SQLi Behind a WAF That Only Blocks the Obvious

A PHP/MySQL 8.0 login form sits behind a cloud WAF. Sending ' OR 1=1-- - returns a generic 403 from the WAF.

520 words, about 3 min
3

The JWT That Was Never Meant to Be Verified

An internal admin SPA issues JWTs to admin.internal.corp . The token header is {"alg":"RS256","kid":"prod-2024"} .

591 words, about 3 min
4

IDOR That Isn't an IDOR

A SaaS app exposes GET /api/v2/documents/{id} returning a document's metadata and a short-lived signed download URL. You are authenticated as tenant A user u1 .

571 words, about 3 min
5

The Upload That Passed Every Check

An image-upload feature accepts PNG/JPEG only. It checks the Content-Type header, the file extension, and runs getimagesize() on the temp file.

599 words, about 3 min