> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ewptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ewptv2-notes/readme.md).
# eWPTv2
**INE Securityβs eWPT is for professional-level Penetration testers that validates that the individual has the knowledge, skills, and abilities required to fulfill a role as a web application penetration tester.**
This certification exam covers **Web Application Penetration Testing Processes and Methodologies**, Web Application Analysis and Inspection, and much more. See the Exam Objectives below for a full description.
This exam is designed to be a milestone certification for someone with foundational experience in **web application penetration testing**, simulating the skills utilized during a real-world engagement. This exam truly shows that the candidate has what it takes to be part of a high-performing penetration testing team.
## Course duration & Topics β³π
\~ 106 hours (**10** courses , **175** videos, **126** quizzes, **58** labs)
* [**Introduction to Web App Security Testing (WAPT)**](/ewptv2-notes/readme/system-security.md) \~ 11 hours
* [**Web Fingerprinting and Enumeration (Information Gathering)**](/ewptv2-notes/readme/network-security.md) \~ 10 hours
* [**Web Proxies**](/ewptv2-notes/readme/powershell-for-pt.md) \~ 12 hours
* [**Cross-Site Scripting (XSS)**](/ewptv2-notes/readme/system-security-1.md) \~ 9 hours
* [**SQL Injection (SQLi)** ](/ewptv2-notes/readme/system-security-2.md)\~ 17 hours
* [**Common Attacks**](/ewptv2-notes/readme/5.5-other-common-web-attacks.md) \~ 12 hours
* [**File & Resource Attacks**](/ewptv2-notes/readme/system-security-3.md) **& Web Service Security Testing** \~ 11 hours + 5 hours
* [**CMS Pentesting** ](/ewptv2-notes/readme/system-security-4.md)\~ 9 hours
* [**Encoding, Filtering & Evasion**](/ewptv2-notes/readme/system-security-5.md) \~ 8 hours
π£οΈ [**RoadMap / Exam Preparation**](/ewptv2-notes/roadmap-exam-preparation.md) π§π»βπ«
## E-Links ππ
* Where to find the Web Application Penetration Tester course? - [INE Learning Paths](https://my.ine.com/CyberSecurity/learning-paths/8c322180-1499-40c7-af8f-a877554fca3d/web-application-penetration-testing-professional-ewptv2)β
* Where to find the eWPTv2 certification exam? - [eWPT](https://security.ine.com/certifications/ewpt-certification/)β
## Training and Labs
{% embed url="" %}
* [How to install Xampp and Mutillidae II ](https://subscription.packtpub.com/book/security/9781788624039/1/ch01lvl1sec04/installing-mutillidae-on-linux)
* [PortSwigger Web Sec Academy](https://dev-angelist.gitbook.io/writeups-and-walkthroughs#portswigger-web-security-academy)
* [DVWA](https://dev-angelist.gitbook.io/dvwa-web/)
* [SecureBank](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/secure-bank)
## β[eWPT](https://security.ine.com/certifications/ewpt-certification/) Exam πποΈ
* **Exam Type**: Multiple-choice quiz (throught lab environment)
* **Time limit**: 10 hours
* **Expiration date**: 3 years
* **Objectives**:
**Web Application Penetration Testing Processes and Methodologies (10%)**
* Accurately assess a web application based on methodological, industry-standard best practices
* Identify vulnerabilities in web applications in accordance with the OWASP Web Security Testing Guide
**Information Gathering & Reconnaissance** (10%)
* Extract information from websites using passive reconnaissance & OSINT techniques
* Extract information about a target organizationβs domains, subdomains, and IP addresses
* Examine Web Server Metafiles for information exposure
**Web Application Analysis & Inspection** (10%)
* Identify the type and version of a web server technology running on a given domain
* Identify the specific technologies or frameworks being used in a web application
* Analyze the structure of web applications to identify potential attack vectors
* Locate hidden files and directories not accessible through normal browsing
* Identify and exploit vulnerabilities caused by the improper implementation of HTTP methods
**Web Application Vulnerability Assessment** (15%)
* Identify and exploit common misconfigurations in web servers
* Test web applications for default credentials and weak passwords
* Bypass weak/broken authentication mechanisms
* Identify information disclosure vulnerabilities
**Web Application Security Testing** (25%)
* Identify and exploit directory traversal vulnerabilities for information disclosure
* Identify and exploit file upload vulnerabilities for remote code execution
* Identify and exploit Local File Inclusion(LFI) and Remote File Inclusion(RFI) vulnerabilities
* Identify and exploit Session Management vulnerabilities
* Exploit vulnerable and outdated web application components
* Perform bruteforce attacks against login forms
* Identify and exploit command injection vulnerabilities for remote code execution
**Manual Exploitation of Common Web Application Vulnerabilities** (20%)
* Identify and exploit Reflected XSS vulnerabilities
* Identify and exploit Stored XSS vulnerabilities
* Identify and exploit SQL Injection vulnerabilities
* Identify and exploit vulnerabilities in content management systems
* Extract information and credentials from backend databases
**Web Service Security Testing** (10%)
* Identify and enumerate information from web services
* Exploit vulnerable web services
## Resources ππ
### π [RoadMap / Exam Preparation for eWPTv2](/ewptv2-notes/roadmap-exam-preparation.md) π£οΈ
### [π eWPTv2 Cheat Sheet π](/ewptv2-notes/ewpt-cheat-sheet.md)
> π [Read the Lab Guidelines ](https://drive.google.com/file/d/1eSnfhypqA67dYyCU5wzquCjF3ymlqjm6/view)π