Skip to content
CertGPS

INE Security Web Application Penetration Tester

Hands-on INE Security web pentest exam tied to the OWASP Web Security Testing Guide, with exploitation domains carrying 45% of the weight

IntermediateINE Security

The exam

Exam cost
$450
Study time
3-5 months
Passing score
Not published by INE
Valid for
3 years

Before you book

  • None required
  • Required to buy the voucher: an active INE Premium subscription (or the eWPT + 3 months Premium bundle)
  • Recommended: basic understanding of networks and systems
  • Recommended: INE Web Application Penetration Testing Professional learning path

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. INE Security Junior Penetration Tester

    Entry

    Comes before. eJPT's 15% web domain previews what eWPT tests in depth

  2. INE Security Web Application Penetration Tester

    You are here

  3. INE Security Certified Professional Penetration Tester

    Advanced

    Next step. Adds Active Directory and network exploitation to an eWPT holder's web skills

Study guide

Last updated

eWPT Study Guide: INE's Web Pentest Exam, Domains and Prep

The eWPT is INE Security's professional-level web application testing exam, relaunched in October 2023 and now graded automatically, with results in hours. INE ties its first domain to the OWASP Web Security Testing Guide, and nearly half the weight sits in two hands-on domains. Before you buy, know that the voucher is sold only alongside an INE subscription and that the credential now lasts three years.

Who the eWPT suits

It fits a developer moving into application security, a tester who has done network work and wants to specialise, or a bug bounty hunter who'd like a credential behind the findings. INE's audience list includes junior penetration testers, web application developers and general IT professionals, and the page asks only for a basic understanding of networks and systems.

If you've never tested anything, eJPT is the gentler start, and its 15% web domain is a preview of this exam. If you already test web applications for a living, go straight to eWPTX, INE's advanced web exam with a quarter of its weight on APIs. Teams that buy GIAC training may prefer GWAPT, GIAC's web application testing certification.

eWPT exam facts

eWPT
FormatPractical web application lab exam, auto-graded
Questions, time, pass markNot stated on INE's public pages
Price (US)$450 voucher for current INE Premium subscribers; $599 eWPT + 3 months of Premium
Voucher termsValid 180 days; one free retake, taken within 14 days of a failed attempt and before expiry
ResultsWithin a few hours, with a score report by exam section
PrerequisitesNone
ValidityThree years; renew with 36 CPE credits plus $99, a higher INE certification plus $99, or by passing the latest version at no fee

The $599 bundle continues at $350 for nine more months of Premium, then $799 a year, unless you cancel before the first renewal.

Seven domains, mostly hands-on

INE's weights:

  • Web Application Security Testing: 25%
  • Manual Exploitation of Common Web Application Vulnerabilities: 20%
  • Web Application Vulnerability Assessment: 15%
  • Web Application Penetration Testing Processes and Methodologies: 10%
  • Information Gathering & Reconnaissance: 10%
  • Web Application Analysis & Inspection: 10%
  • Web Service Security Testing: 10%

The two largest domains, 45% between them, cover the flaws that appear in almost every web testing course: injection, cross-site scripting, file handling and session weaknesses, plus content management systems and outdated components. The outline is classic server-rendered web testing. Modern APIs, OAuth and single sign-on appear only in eWPTX, so the eWPT name promises a little more breadth than the exam delivers.

Methodology is only 10%, but it shapes how you should work. INE's objective asks you to assess an application "in accordance with the OWASP Web Security Testing Guide", so a candidate who follows that guide's structure will cover reconnaissance, configuration and authentication checks in a sensible order. Web services get their own 10%, which is the closest the outline comes to API work. The three remaining 10% and 15% domains are groundwork: passive reconnaissance and subdomain discovery, fingerprinting the server and framework, finding hidden files and misused HTTP methods, and checking for default credentials and misconfiguration.

A study plan built on the OWASP guide

INE's recommended route is the Web Application Penetration Testing Professional learning path, included with Premium and the bundle. Use it as your syllabus.

Two free resources fill the gaps well. The OWASP Web Security Testing Guide is worth reading section by section alongside the methodology domain, since the exam names it directly. PortSwigger's Web Security Academy has labs on SQL injection, cross-site scripting, path traversal, file upload, command injection and authentication, which together map onto most of the 45% exploitation weight. Do those labs with Burp Suite, PortSwigger's own testing proxy.

We'd split time roughly in proportion to the weights: about half on security testing and manual exploitation, a fifth on assessment and analysis, and the rest on reconnaissance, methodology and web services. Leave a week to work a full application end to end without hints, because the exam doesn't tell you which flaw a target has.

Keeping it current, and what comes next

The eWPT is valid for three years from the date it's awarded. INE's renewal program accepts 36 continuing professional education (CPE) credits or a more advanced certification on the same career path, each with a $99 fee, or a pass on the newest eWPT at no fee. Renewal opens 18 months before expiry; a lapsed certification can be renewed for $199 within 90 days.

INE's Web Application Penetration Tester path runs eJPT, eWPT, eWPTX. Options from here:

  • eWPTX, which also keeps your eWPT renewable.
  • OSWE, OffSec's 48-hour proctored exam built on source code review.
  • eCPPT, if you want network and Active Directory work alongside web skills.

Our view

The eWPT covers the right material for a first web credential, and at $599 with three months of training it costs far less than OffSec's $1,749 course-and-exam bundle. Its alignment with the OWASP testing guide is a real strength, because it gives a client a published method to check the work against. What it lacks is any test of reporting or of modern API work, and INE doesn't publish the exam's length or pass mark on its public pages, which makes it harder for an employer to judge. Buy it if you want structured web training with an exam at the end; the free retake and per-domain score report make a first failure cheap to recover from. If you already work as a web tester, eWPTX or OSWE will say more about you.

Sources