---
description: INE/eLearnSecurity Web Application Penetration Tester eXtreme (eWPTXv3) Notes
---

# eWPTXv3

<div align="center"><figure><img src="https://2193463354-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRpANgsg91cAWGMlAJ255%2Fuploads%2FeMmxSs9jUWmg1DYbA7P3%2FeWPTX.png?alt=media&#x26;token=957c9af2-7d06-47bf-bcc5-d68e51d1fd3c" alt=""><figcaption><p><a href="https://security.ine.com/certifications/ewptx-certification/">https://security.ine.com/certifications/ewptx-certification/</a></p></figcaption></figure></div>

The **INE Security’s Web Application Penetration Tester eXtreme** certification is a hands-on exam designed for cybersecurity professionals with intermediate to advanced expertise in web application security and penetration testing. This certification assesses and validates the advanced knowledge, skills, and abilities necessary for the role of a modern web application penetration tester.

## Course duration & Topics ⏳📚 <a href="#course-duration-and-topics" id="course-duration-and-topics"></a>

\~ 77 hours (**6** courses, **122** videos, **90** quizzes, **39** labs)

* [**Web Application Penetration Testing Methodology**](readme/system-security) (10%)
  * Accurately assess a web application based on methodological, industry-standard best practices.
  * Identify and prioritize testing objectives based on business impact and risk assessment.
* [**Web Application Reconnaissance**](readme/network-security) (15%)
  * Perform a comprehensive passive and active reconnaissance on designated target web applications by utilizing tools and techniques such as WHOIS lookups, DNS enumeration, and network scanning.
  * Extract information about a target organization’s domains, subdomains, and IP addresses.
  * Utilize fuzzing techniques to discover input validation vulnerabilities in web applications.
  * Utilize Git-specific tools to automate the discovery of secrets and vulnerabilities in code.
* [**Authentication Attacks**](readme/5.5-other-common-web-attacks) (15%)
  * Test various authentication methods (e.g., Basic, Digest, OAuth) by executing practical attacks such as credential stuffing and brute force.
  * Identify common vulnerabilities in SSO implementations and their potential impacts.
  * Identify and exploit Session Management vulnerabilities (e.g., session fixation and hijacking).
  * Identify and exploit weaknesses in OAuth and OpenID Connect protocols.
* [**Injection Vulnerabilities**](readme/5.5-other-common-web-attacks-1) (15%)
  * Identify and exploit SQL injection vulnerabilities in web applications, including error-based, blind, and time-based techniques.
  * Utilize SQLMap and other tools to automate SQL injection attacks and demonstrate effective exploitation.
  * Identify and exploit NoSQL injection vulnerabilities in web applications, demonstrating hands-on skills in manipulating data in NoSQL databases.
  * Extract sensitive data from compromised databases using advanced querying techniques.
* [**API Penetration Testing**](readme/system-security-1) (25%)
  * Conduct hands-on penetration tests on API endpoints to identify and exploit vulnerabilities effectively.
  * Utilize automation tools for API vulnerability testing and demonstrate efficiency in identifying vulnerabilities.
  * Analyze API endpoints for potential parameter manipulation vulnerabilities and demonstrate exploitation techniques.
  * Conduct tests to identify vulnerabilities related to rate limiting, such as denial-of-service (DoS) attacks and resource exhaustion.
  * Demonstrate the ability to bypass or manipulate rate limiting mechanisms in a controlled testing environment.
* [**Server-Side Attacks**](readme/system-security-2) (10%)
  * Identify and exploit SSRF (Server-Side Request Forgery) attacks against server-side services.
  * Perform deserialization attacks to manipulate server-side objects, leading to arbitrary code execution or privilege escalation.
  * Perform LDAP injection attacks against web application directories to bypass authentication or extract sensitive information.
* [**Filter Evasion & WAF Bypass** ](readme/system-security-3)(10%)
  * Analyze and test WAF rules to identify weak configurations, demonstrating practical bypass techniques.
  * Perform hands-on WAF evasion techniques, such as encoding, obfuscation, and payload fragmentation, to bypass filtering mechanisms.
  * Bypass input validation mechanisms through obfuscation, payload encoding, and altering content types, focusing on SSRF and XXE exploitation.

🛣️ [**RoadMap / Exam Preparation**](roadmap-exam-preparation) 🧑🏻‍🏫

## E-Links 🔗📔 <a href="#useful-links" id="useful-links"></a>

* Where to find the Web Application Penetration Tester course? - INE Learning Paths​
* Where to find the eWPTXv3 certification exam? - [eWPT​Xv3](https://security.ine.com/certifications/ewptx-certification/)

## Training and Labs

* [How to install Xampp and Mutillidae II ](https://subscription.packtpub.com/book/security/9781788624039/1/ch01lvl1sec04/installing-mutillidae-on-linux)
* [PortSwigger Web Sec Academy](https://app.gitbook.com/s/rRWtuMw6xkkeDjZfkcWC/#portswigger-web-security-academy)
* [DVWA](https://app.gitbook.com/o/s2H3MdEB0Qp2IbE58Gxw/s/l27MAim0y0z73W12Z3gU/)
* [SecureBank](https://app.gitbook.com/s/rRWtuMw6xkkeDjZfkcWC/secure-bank)
* BWAPP

## ​eWPTXv3 Exam 📄🖊️ <a href="#ejpt-exam" id="ejpt-exam"></a>

* **Exam Type**: Multiple-choice quiz (throught lab environment)&#x20;
* **Time limit**: 18 hours
* **Expiration date**: 3 years

## Resources 📑📘

### 👉 [RoadMap / Exam Preparation for eWPTXv3](roadmap-exam-preparation) 🛣️

### 👉 [eWPTXv3 Cheat Sheet ](ewptx-cheat-sheet)📔

> 📖 [Read the Lab Guidelines](https://drive.google.com/file/d/1wiBv8C4jya4bKilHlHmbFi7fvsyGoceA/view) <mark style="color:yellow;">📖</mark>
