eWPTXv2 Certification Review

eLearnSecurity Web application Penetration Tester eXtreme (eWPTXv2) is a real-life practical black box penetration test by *INE security*. The focus is on assessing your proficiency in web application penetration testing skills, advanced reporting & remediation, WAF evasion, and custom exploit development.

Target Audience

In my opinion, I do not consider this certification to be at an expert level. Rather, it falls under the category of an intermediate certificate. It would be particularly advantageous for individuals who possess 2 or more years of experience in application security. However, even freshers with sufficient technical knowledge can pursue this certification.

Note: Please be aware that I have not completed the courseware as I possess practical experience in Web Application Penetration Testing. Nevertheless, I highly advise newcomers to thoroughly review the courseware and engage in practice labs.

Topics covered

eWPTXv2 covers following concepts one is expected to know before enrolling for the exam: -Note: This list is not exhaustive

1. Encoding, Filtering and Evasion
2. SQL Injection
3. Authentication
4. Directory traversal
5. Command Injection
6. Information Disclosure
7. Access Control
8. Server-side request forgery (SSRF)
9. XXE Injection
10. Cross-site Scripting (XSS)
11. Cross-site request forgery (CSRF)
12. Server-side template injection (SSTI)
13. Insecure deserialization

Exam

Type: Practical black box penetration

This is not a CTF / MCQ / point-based exam. It’s a real-life scenario-based exam based on practical black box penetration test where there are multiple targets to pen test. When you start the exam, you will be given Letter of Engagement which explains the scope and objective in detail

INE emphasis on exploiting vulnerabilities and documenting each step of exploitation.

Exam Cost: $400. This does not include courseware and practice labs, only the exam. You get 180 days to redeem your voucher

Duration: Days for Exam + 7 Days for Reporting. (The Exam Environment won’t be accessible after 7 days from the exam start date.)

Pre-Scheduling: Not Required. Start anytime

Proctored: No

Tool Restriction: None

My Experience

My experience was rather unique, I suppose, for two main reasons.

• Firstly, the testing environment was quite unstable, which made the process quite exhaustive
• Secondly, INE mistakenly associated my name with my avatar, leading me to seek assistance from their support team. Although it was a taxing experience, their support was quite helpful, and everything was eventually resolved. I would like to express my gratitude to Sergio Aguilar for his assistance.
• Lastly, setting up openVPN was time-consuming due to the outdated version used by INE.

During the exam, I had multiple targets to focus on. To ensure efficiency, I followed a methodology of completing one target before moving on to the next. While there were numerous places to confirm vulnerability, only a few input areas allowed for full exploitation.

My Advice

• Fully Pentest one target before moving to next one
• Exam environment is stable. You can think of it as client UAT environment where blinding running automated tools may crash or slow the servers
• Use your reset carefully, as only 4 Resets in a 24-Hour window are allowed
• If payloads do not work first time, don’t panic try filters or other possible payloads before resetting the machine
• Take proper screenshots as soon as the vulnerability is confirmed
• Since this is a real-life scenario-based exam, make sure to find and exploit as many vulnerabilities as you can
• If you get stuck, take a break☕️
• Lastly, don’t forget to Google😁

Free Resources

PortSwigger Academy

Pentester Lab

https://github.com/CyberSecurityUP/eWPTX-Preparation

Useful Links

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Insecure%20Deserialization/PHP.md#object-injection

https://github.com/daffainfo/AllAboutBugBounty/blob/master/Host%20Header%20Injection.md

https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection

https://www.doyler.net/security-not-included/ewptx-review

https://medium.com/@drag0n/sqlmap-tamper-scripts-sql-injection-and-waf-bypass-c5a3f5764cb3

https://github.com/frohoff/ysoserial

https://cheatsheetseries.owasp.org/IndexTopTen.html

If you enjoyed reading the article do give a clap and kindly follow .