🕸️eWPT Review🔍

Paywall blocking you? Click here to reload and enjoy for free.

Learn from my mistakes and how to pass the eWPT exam. Also some hot takes on eLearnSecurity certifications compared to other offensive security related certs.

• The Good: discusses the great aspects of INE trainings and tips on studying for the eWPT exam.
• The Bad: is a critque of eLearnSecurity certifications in general and clarifying that this is a certification for knowledge more than resume prowess.
• The Ugly: The stupid mistakes I made that failed my first attempt.

The Good

The eWPT is eLearnSecurity’s web application penetration testing focused certification. Compared to the OSCP, the material is slightly more in depth than what you’ll learn on your typical “OSCP Journey”(offsec materials and extra stuff picked up from Hack the Box, etc.). I’m going to make al ot of comparisons to the Offensive Security Certified Professional certification as it’s seen as the pentesting industry gate keeping cert and has much industry recognition.

The INE Course

The “learning” side of eLearnSecurity is handled by a company they have partnered with called INE. The materials are fairly solid, though they are a bit dated now. They still have a course module about Flash security.

However, the biggest positive with the course it that it actually has all the information you need to pass the exam! You don’t need to go to 3rd party services because the original course material isn’t conclusive enough, unlike other offensive security related certifications. INE has all the information needed for someone to go from “zero-to-hero” to pass eWPT. From the basics of HTTP requests and response to SQLi, XSS, and exploiting SOAP.

The labs are very well done. Rather than a huge, disorganized lab environment that you have to share with many other students, the eWPT labs have individual instances for each student separated by topic. For XSS you have your own environment created for exploiting XSS, for SQLi you have your own instance for exploiting SQLi. The only annoying thing is you have to re-authenticate with a different VPN certificate and credentials every time to boot up a new instance to practice in. That’s better…