I85PREP
⌘ K
PJPT study materials
PJPT study resources

PJPT: Web Application Penetration Testing

PJPT · Work through your exam, one topic at a time.

All guide sections

Web Application Penetration Testing

What the exam tests

Web application penetration testing on PJPT is usually a path to credentials or a foothold rather than a standalone bug hunt. The exam tests methodical mapping of an application, authentication testing, input handling, and access control checks.

Core rules and concepts

  • Map the app with Burp Suite: spider, inspect robots.txt, sitemap.xml, JavaScript files, and API routes.
  • Test authentication and session handling: default credentials, username enumeration, weak password policy, cookie flags, and session fixation.
  • Check authorization at every object: change IDs, roles, and tenant values to test IDOR and vertical privilege escalation.
  • Test injection points with safe payloads; use sqlmap only with --batch --risk=1 --level=1 and never --dump-all unless authorized.
  • Review file upload, path traversal, SSRF, and XXE where the feature exists; confirm impact with a controlled read, not a destructive write.

Worked example

A web app exposes /api/invoice?id=1042. You log in as a low-privileged user, intercept the request in Burp, and change id to 1041. The response returns another user's invoice. Reasoning: the endpoint lacks object-level authorization (IDOR). You verify with a second ID, record both requests and responses, and rate the finding as high because it exposes financial data across tenants.

Traps

Testing only the login page, ignoring JavaScript-discovered endpoints, running aggressive sqlmap against production-like systems, and reporting a reflected payload without demonstrating impact. Also: missing cookie Secure/HttpOnly flags and forgetting to check logout invalidation.