eWPTX study plan
eWPTX · Give each week a clear focus.
8 weeks · About 7 hours per week
Advanced Web Application Penetration Testing
Map every objective in Domain 1 to a personal confidence rating (1-5) and flag the five lowest-scoring areas
Set up an isolated lab with a vulnerable web app plus an intercepting proxy and confirm full request/response visibility
Rehearse the standard recon-to-exploit workflow end to end on one target without notes
Write a one-page glossary of the core web attack categories you must be able to explain from memory
Your checkpoint
A scored Domain 1 objective matrix (1-5 per objective) with the five weakest areas ranked and a lab screenshot log proving proxy interception works
Advanced Web Application Penetration Testing
Exploit injection-style flaws (SQLi, command injection, template injection) against the lab and capture each payload that works
Bypass authentication and session controls by manipulating tokens, cookies, and access-control checks
Demonstrate both reflected and stored cross-site scripting with a working proof-of-concept payload for each
Document, for each finding, the root cause and the concrete remediation
Your checkpoint
An exploitation notebook containing at least 10 verified findings across injection, auth/session, and XSS, each with request/response evidence and a remediation note
Advanced Web Application Penetration Testing
Test server-side request forgery, file inclusion, and insecure deserialization paths in the lab
Enumerate and abuse API endpoints, including broken object-level authorization and mass assignment
Chain two low-severity flaws into one higher-impact exploit and record the chain step by step
Practice writing a clear executive summary plus technical detail for one of the chained findings
Your checkpoint
A written mini-report (2-3 pages) documenting one multi-step exploit chain from initial flaw to impact, with reproduction steps
Advanced Web Application Penetration Testing
Complete a timed 40-question mixed drill covering all Domain 1 sub-areas and review every miss
Explain aloud, without notes, the mechanism and fix for each attack class you got wrong
Re-score your Domain 1 objective matrix and confirm every objective is at confidence 4 or higher
Your checkpoint
A drill score log (score, per-topic breakdown, corrected explanations for every missed question) plus an updated objective matrix showing no objective below 4
Real-World Pentesting Simulation
Run a full simulated engagement from scoping and rules of engagement through recon, exploitation, and reporting
Apply a repeatable methodology checklist so no phase is skipped under time pressure
Prioritize findings by real business impact rather than raw severity score
Practice time-boxing each phase and record where you overran
Your checkpoint
A complete penetration test report for the simulated target, including scope, methodology, prioritized findings, and remediation guidance
Real-World Pentesting Simulation
Adapt your methodology to a second, structurally different target (different stack and attack surface)
Triage and exploit under partial information, deciding when to pivot versus dig deeper
Write findings so a non-technical stakeholder can act on them
Identify the three decisions that most affected your result and note what you would change
Your checkpoint
A second full report plus a short retrospective listing three methodology adjustments for the next run
Advanced Web Application Penetration Testing & Real-World Pentesting Simulation
Complete a full-length timed mock exam under exam conditions and record section-level timing
Categorize every incorrect answer by root cause (knowledge gap, misread, or time pressure)
Re-drill only the weak categories until you clear them twice in a row
Rehearse concise verbal explanations of the highest-frequency concepts
Your checkpoint
A mock exam results sheet with score, timing per section, root-cause tags for every miss, and proof that weak categories were re-drilled to a passing rate
Advanced Web Application Penetration Testing & Real-World Pentesting Simulation
Take a second full-length timed mock and compare against week 7 to confirm improvement
Review your consolidated notes and error log only, avoiding new material
Finalize a one-page pre-exam checklist of methodology steps and common pitfalls
Simulate exam-day logistics (environment, timing, breaks) once end to end
Your checkpoint
A final readiness packet: second mock score with week-over-week delta, a one-page pre-exam checklist, and a go/no-go readiness decision
Milestones
Week 2: At least 10 verified Domain 1 findings documented with evidence and remediation, covering injection, auth/session, and XSS
Week 4: Domain 1 drill passed at target score and every objective rated confidence 4 or higher on the objective matrix
Week 6: Two complete simulated engagement reports produced on structurally different targets, each with prioritized findings
Week 7: First full-length timed mock completed with section timing recorded and every miss root-cause tagged
Week 8: Second mock score improved over week 7, pre-exam checklist finalized, and a documented go/no-go readiness decision