Skip to content
CertGPS

GIAC Web Application Penetration Tester

Proves you can test web applications as an attacker would, on a GIAC exam that includes hands-on CyberLive tasks in live virtual machines

IntermediateGIAC

The exam

Exam cost
$999
Study time
3-5 months
Passing score
71%
Valid for
4 years

Before you book

  • None required by GIAC
  • Optional training: SANS SEC542, which assumes basic Linux command-line skills
  • Recommended: practical web application testing experience

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. GIAC Web Application Penetration Tester

    You are here

  2. OffSec Web Expert

    Expert

    Next step. Adds OffSec's 48-hour proctored white-box exam built on finding flaws in source code

Study guide

Last updated

GWAPT Study Guide: GIAC's Web App Pen Testing Exam, SEC542 and a Plan

The GIAC Web Application Penetration Tester (GWAPT) certification says you can attack a web application the way a paid tester does: map it, break its login, inject SQL, forge requests on a victim's behalf. It's the offensive half of GIAC's two web credentials. Know before you buy that the exam includes CyberLive items, which put you in live virtual machines alongside the multiple-choice questions.

Who GWAPT is for, and when GWEB fits better

GWAPT suits a network penetration tester who keeps getting web applications in scope, a consultant who wants a repeatable method to replace scanner output, and an application security engineer who has to prove findings before developers will fix them. GIAC lists penetration testers, ethical hackers, web developers and site architects as its audience.

If you build or defend applications and rarely attack them, look at the GIAC Certified Web Application Defender (GWEB) instead. It covers many of the same flaws, from SQL injection to cross-site request forgery (CSRF), but asks how to prevent and detect them, and it adds API, federation and AI topics that GWAPT's objectives don't name. If you already test applications and want a harder practical exam, skip ahead to OSWE.

GWAPT exam facts

GWAPT
Format82 questions, including CyberLive hands-on items in virtual machines; GIAC doesn't publish how many
Time3 hours
Passing score71% (exam versions released on or after May 16, 2016)
Price$999 per attempt; $899 retake; $399 per practice test
DeliveryProctored online through ProctorU or at a Pearson VUE test center; 120 days from activation to sit it
Materials allowedPrinted books, notes and your own index; nothing electronic
PrerequisitesNone set by GIAC; SEC542 assumes basic Linux command-line skills
ValidityFour years; renew with 36 CPEs and a $499 fee, or by retaking the current exam

The eight objectives, and where SEC542 goes further

GIAC doesn't weight its objectives, so treat these eight as equal until your practice test says otherwise:

  • Web application overview: HTTP, HTTPS and AJAX in a security context
  • Reconnaissance and mapping: port scans, service and configuration discovery, spidering, flow charting, session analysis
  • Configuration testing
  • Authentication attacks: user enumeration and bypassing weak authentication
  • Session management, including SSL/TLS and attacks on session state
  • SQL injection
  • Cross-site scripting, CSRF and client injection
  • Testing tools: proxies, fuzzing, scripting and attacks on application logic

The list is older and narrower than the course behind it. SEC542, the SANS course GIAC pairs with GWAPT, was rewritten around the OWASP Web Security Testing Guide and now covers server-side request forgery (SSRF), XML external entities, server-side template injection, prototype pollution, NoSQL injection, insecure deserialization and the OWASP Top 10 for LLM applications. SANS's own mapping puts that whole server-side section under the SQL injection objective. Study to the eight objectives first. The newer topics make good practice, but GIAC's list doesn't name them.

CyberLive changes how you should study. GIAC says these items are typically weighted more than multiple-choice questions, get more time, and come at the end of the exam. It also warns that a candidate who can't answer most of them shouldn't expect to pass. Being able to drive Burp Suite under a clock is worth more than another pass through your notes.

Preparing with or without SEC542

SEC542 runs six days in person or about 36 hours self-paced, with 35 labs and a closing capture-the-flag day. SANS lists most current sessions at $8,780 before tax, plus the GIAC attempt if you add it; SANS includes two practice tests when you do. The labs use Burp Suite Professional, OWASP ZAP and Caido as proxies, with ffuf, sqlmap, the Browser Exploitation Framework (BeEF) and Metasploit for the heavier work.

Without the course, you can cover the objectives with free material. PortSwigger's Web Security Academy has free labs on SQL injection, cross-site scripting (XSS), CSRF and authentication, which cover three of the eight objectives directly. Use the OWASP Web Security Testing Guide as your checklist for reconnaissance and configuration testing, and run OWASP Juice Shop locally for a target that rewards a full test rather than a single bug.

GIAC's survey figure is a sensible budget: certified candidates report about 55 hours of study beyond any classroom time, and GIAC says first-timers can need three times that. A split that fits this exam:

  • Weeks 1 to 3: HTTP, sessions and TLS until you can read raw requests without help; proxy setup and spidering
  • Weeks 4 to 7: one objective a week in labs, writing up each exploit in your own words
  • Week 8: build the printed index the open-book rules allow, organized by objective
  • Weeks 9 to 10: first practice test, then rework every objective scored under four stars

Take the first practice test seriously. GIAC says it's a better gauge than later ones, and the practice bank is small enough that questions repeat. Use it with the same printed index you'll bring, since you can't go back to answered questions on the real exam, only skip ahead and return.

Retakes, renewal and what comes after GWAPT

A failed attempt means a 30-day wait. A retake costs $899 and pushes your deadline out by 60 days. After three failures the attempt ends and GIAC makes you wait a year before buying a new one.

The credential lasts four years. Renew it with 36 continuing professional education (CPE) credits and a $499 fee, and a second GIAC renewal within two years of a full-price one costs $249. SANS courses and new GIAC certifications share a category capped at 36 CPEs, the full requirement, so one course can cover the whole cycle; SEC542 itself is listed at 36. Renewal adds four years from your current expiry date, not from the day you pay.

Next steps:

  • GIAC Certified Web Application Defender (GWEB) for the defensive side of the same flaws, useful if you write remediation advice
  • OSWE, OffSec's 48-hour proctored exam built on white-box testing and finding flaws in source code, with a written report
  • GPEN if your engagements also cover networks and Azure

Our view

GWAPT is respected because GIAC exams are hard to pass on memory alone, and the CyberLive section makes that truer. Its weakness is age. The objective list still opens with AJAX, and it doesn't name APIs, SSRF or deserialization, which are now routine findings. The bigger issue is cost: at $999 for the attempt alone, with SEC542 listed at $8,780 on top, it makes most sense when an employer pays or a client contract asks for GIAC. If you're paying yourself, PortSwigger's free labs and a practical exam will teach you more per dollar, though they won't carry GIAC's name with clients who look for it.

Sources