The eWPTX is the most advanced web application exam INE Security offers, and since its December 2024 update the largest share of it is about APIs. API testing alone carries 25% of the weight, more than injection or authentication. Like INE's other current exams, it's a practical lab exam graded automatically, and the certification now expires after three years.
Who should attempt eWPTX
INE aims it at people with advanced penetration testing experience that includes web applications: working web testers, red team operators, bug bounty hunters and application security engineers who test their own products. INE's list also names software developers and DevSecOps engineers. If your daily work involves APIs, single sign-on and web application firewalls, the syllabus will look like your job.
It's the wrong first web credential. Without regular web testing experience, take eWPT first; it covers the classic server-side flaws that eWPTX assumes you already know. If you're more interested in reading application source code than testing a running system, OSWE is the better fit.
eWPTX exam facts
| eWPTX (December 2024 version) | |
|---|---|
| Format | Practical web application lab exam, auto-graded |
| Questions, time, pass mark | Not stated on INE's public pages |
| Price (US) | $450 voucher for current INE Premium subscribers; $599 eWPTX + 3 months of Premium |
| Voucher terms | Valid 180 days; one free retake, taken within 14 days of a failed attempt and before expiry |
| Results | Within a few hours, with a score report by exam section |
| Prerequisites | None; designed for candidates with advanced penetration testing experience |
| Validity | Three years; renew with 36 CPE credits plus $99, or by passing the latest version at no fee |
The bundle renews at $350 for a further nine months of Premium after the first three, then $799 a year, unless you cancel.
What the seven domains cover
Weights from INE's certification page and its December 2024 launch announcement:
- API Penetration Testing: 25%
- Web Application Reconnaissance: 15%
- Authentication Attacks: 15%
- Injection Vulnerabilities: 15%
- Web Application Penetration Testing Methodology: 10%
- Server-Side Attacks: 10%
- Filter Evasion & WAF Bypass: 10%
The API domain is broader than the name suggests. INE's objectives include automated API testing, parameter handling and rate limiting, so practise testing how an API copes with repeated, automated requests. Authentication goes past login forms into single sign-on, OAuth and OpenID Connect, and the injection domain includes NoSQL databases as well as SQL, with SQLMap named in the objectives.
The two 10% domains on server-side attacks and filter evasion are where we'd expect most candidates to need extra practice. Server-Side Attacks lists request forgery, deserialization and LDAP injection. Filter Evasion & WAF Bypass asks you to test how a web application firewall's rules can fail, which is hard to practise without a lab that has one. Reconnaissance also has a modern edge: one objective covers tools that search Git repositories for secrets.
Methodology is 10%, and INE frames it as prioritising testing by business impact and risk. In a timed lab with many possible paths, judging where to spend your hours counts.
Preparing for the API and server-side domains
INE's training for this exam is the Advanced Web Application Penetration Testing learning path, included with Premium and the bundle. The subscriber note on INE's eWPTX page points to the Threat Hunting Professional path instead; that looks like a copy error, and the bundle description and the path title both point to the web path.
For practice outside INE, PortSwigger's free Web Security Academy has advanced topics that line up with this outline: API testing, GraphQL, OAuth authentication, JWT attacks, NoSQL injection, server-side request forgery, XXE injection and insecure deserialization. The OWASP API Security Top 10 (2023 edition) is the reference to read beside the API domain, since it lists the classes of API weakness a tester is expected to recognise.
A sensible split follows the weights: about a third of your hours on APIs, a quarter on authentication and injection together, and the rest shared between server-side flaws, filter evasion and reconnaissance. Leave time to test a full application from scratch, because the exam won't tell you where the weaknesses are.
Renewal from the top of INE's web path
The certification is valid for three years from the award date. Renewal works through INE's program: 36 continuing professional education (CPE) credits with a $99 fee, or a pass on the newest eWPTX at no fee. Renewal opens 18 months before expiry, and the late fee within the 90-day grace period is $199. The higher-certification route doesn't apply, because no INE web certification sits above this one.
Because eWPTX sits at the top of two INE career paths, holding it also lets you renew eJPT, eCPPT and eWPT. Each renewal is charged separately at $99.
From here, OSWE is the natural next exam: a 48-hour proctored test from OffSec built on code review. GWAPT is the sideways move if an employer asks for a GIAC credential.
Our view
The December 2024 syllabus is current, with APIs and WAF bypass taking 35% of the weight and OAuth inside the authentication domain. Its weakness is visibility: INE doesn't publish the exam length or pass mark on its public pages, and an auto-graded exam with no report tells an employer less than a proctored or report-based one. At $599 including three months of training it's good value for an experienced web tester who wants a structured refresh. If you need the credential to carry weight in hiring, we'd point you to OSWE's proctored 48-hour exam instead.
Sources
- INE eWPTX certification page: domains, weights, objectives, audience, learning path, voucher and retake terms, auto-grading, validity, checked October 2026
- INE: Updated eWPTX certification launch: December 2024 update and API weighting, checked October 2026
- INE checkout: eWPTX voucher and bundle: $450 voucher, $599 bundle, renewal billing, checked October 2026
- INE certification renewal: CPE routes, fees, career paths, checked October 2026
- PortSwigger Web Security Academy: advanced lab topics, checked October 2026
- OWASP API Security Top 10: 2023 edition, checked October 2026
- OffSec WEB-300 (OSWE): 48-hour proctored exam, code review, checked October 2026