All Practice Exams
100+ Free eWPTX Practice Questions
eWPTX Web Application Penetration Tester eXtreme (eWPTXv3) practice questions are available now; exam metadata is being verified.
✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free
1 / 100
Question 1
Score: 0/0
Which encoding technique is most commonly used to bypass a WAF blocking the word `UNION` in SQL injection payloads?
A
B
C
D
to track
Same family resources
Explore More INE Security (eLearnSecurity) Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
2026 Statistics
Key Facts: eWPTX Exam
18 hours
Exam Duration
INE Security
75%
Passing Score
INE Security
45
Exam Questions
INE Security
25%
API Security Weight
INE Security eWPTX curriculum
$400
Exam Voucher Cost
INE Security
3 years
Certification Validity
INE Security
The eWPTX (eWPTXv3) is INE Security's most advanced web app pentesting cert. The 18-hour non-proctored practical exam requires compromising a web application lab and answering 45 questions (75% to pass) tied to discovered vulnerabilities. API security (REST, GraphQL, OAuth) comprises 25% of the curriculum. Cost: $400 exam voucher / $600 with 3-month INE Premium. Valid 3 years. One free retake within 14 days of failure.
Sample eWPTX Practice Questions
Try these sample questions to test your eWPTX exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1Which HTTP method should an API penetration tester specifically test beyond GET and POST to check for unintended functionality exposure?
A.Only HEAD and OPTIONS
B.CONNECT and TRACE only
C.PUT, DELETE, PATCH, and OPTIONS
D.Only GET and POST matter for APIs
Explanation: REST APIs often expose PUT (update), DELETE (remove), PATCH (partial update), and OPTIONS (discover allowed methods) endpoints that may lack proper authorization checks. Testers must enumerate all supported HTTP methods on every endpoint, as developers may forget to restrict dangerous methods like DELETE or PUT on sensitive resources.
2During GraphQL API reconnaissance, which query allows an attacker to enumerate all available types, queries, mutations, and fields in the schema?
A.__schema { queryType { name } }
B.{ __typename }
C.{ __schema { types { name fields { name } } } }
D.query { schema { allFields } }
Explanation: GraphQL introspection via `{ __schema { types { name fields { name } } } }` returns the complete type system including all queries, mutations, subscriptions, and field definitions. This is the standard reconnaissance technique against GraphQL APIs; if introspection is enabled in production, attackers gain a full map of the API surface without any documentation.
3When testing OAuth 2.0 implementations, which vulnerability arises when the authorization server does not validate the `redirect_uri` parameter strictly?
A.Authorization code interception via open redirect
B.CSRF on the authorization endpoint
C.Token replay attack
D.JWT algorithm confusion
Explanation: If an OAuth server accepts any `redirect_uri` without strict validation, an attacker can craft an authorization request pointing to an attacker-controlled URL. When the victim authorizes the request, the authorization code is delivered to the attacker's server, allowing the attacker to exchange it for an access token. This is one of the most critical OAuth vulnerabilities.
4An application uses a JWT signed with RS256. The attacker changes the `alg` header to `HS256` and signs the token with the server's RSA public key as the HMAC secret. What attack is this?
A.JWT key injection
B.Algorithm confusion (alg:none) attack
C.Algorithm confusion RS256-to-HS256 attack
D.JWT header parameter injection
Explanation: The RS256-to-HS256 confusion attack exploits JWT libraries that use the same code path for both algorithms. When the attacker downgrades the alg to HS256 and uses the public RSA key as the HMAC secret, a vulnerable library verifies the signature successfully because the public key is known to both parties. The server expects asymmetric verification but performs symmetric verification instead.
5Which tool is the primary industry-standard choice for automated and manual web application penetration testing, including API interception, repeating requests, and active scanning?
A.Burp Suite
B.Nmap
C.Metasploit Framework
D.Nikto
Explanation: Burp Suite is the de facto standard proxy and testing platform for web application penetration testing. It provides an intercepting proxy, Repeater for manual request modification, Intruder for fuzzing, Scanner for automated vulnerability detection, and extensions for API testing. Virtually all advanced web app and API testing workflows center on Burp Suite.
6During passive reconnaissance for a web application, which technique allows discovery of subdomains and SSL/TLS certificate information without sending any packets to the target?
A.Certificate Transparency log querying via crt.sh
B.Active DNS brute-forcing with dnsrecon
C.TCP SYN scanning with Nmap
D.Directory brute-forcing with ffuf
Explanation: Certificate Transparency (CT) logs record every SSL/TLS certificate issued by trusted CAs. Querying crt.sh or similar CT log search engines reveals all subdomains for which certificates have been issued, entirely without sending traffic to the target. This makes it a pure passive recon technique that often uncovers hidden or forgotten subdomains.
7In a time-based blind SQL injection attack, which SQL function is commonly used in MySQL to introduce a deliberate delay to confirm injection?
A.SLEEP(5)
B.WAITFOR DELAY '0:0:5'
C.PG_SLEEP(5)
D.DBMS_PIPE.RECEIVE_MESSAGE('a',5)
Explanation: MySQL uses the `SLEEP(N)` function to introduce a delay of N seconds. In time-based blind SQLi, the attacker injects a condition like `1 AND SLEEP(5)` — if the response is delayed by 5 seconds, the injection is confirmed. Different databases have different delay functions: MSSQL uses WAITFOR DELAY, PostgreSQL uses PG_SLEEP, and Oracle uses DBMS_PIPE.RECEIVE_MESSAGE.
8Which SQLMap flag is used to enumerate all databases on a target with a confirmed SQL injection point?
A.--dbs
B.--dump-all
C.--tables
D.--schema
Explanation: The `--dbs` flag in SQLMap enumerates all available databases accessible through the injection point. The typical workflow is: first confirm injection, then use `--dbs` to list databases, `--tables -D <db>` to list tables, `--columns -T <table>` to list columns, and finally `--dump` to extract data.
9A NoSQL injection payload `{ "username": { "$ne": null }, "password": { "$ne": null } }` sent to a MongoDB login endpoint achieves what result?
A.It causes a denial of service on the database
B.It extracts all usernames from the database
C.It bypasses authentication by matching the first document where neither field is null
D.It inserts a new admin user into the database
Explanation: MongoDB's `$ne` (not equal) operator allows query operators to be injected where string values are expected. This payload translates to 'find a document where username is not null AND password is not null,' which matches the first valid user record and logs the attacker in as that user. This is the classic NoSQL authentication bypass.
10Which recon technique involves searching for exposed `.git` directories on web servers to recover source code and commit history?
A.Git directory enumeration and reconstruction using tools like GitTools or git-dumper
B.Git dorking via GitHub Advanced Search
C.Cloning the repository from the target's public GitHub profile
D.Running git log against the web server's IP
Explanation: When a `.git` directory is left accessible on a web server (e.g., https://target.com/.git/), tools like GitTools or git-dumper can download the raw git objects and reconstruct the full repository including source code, configuration files, and commit history. This often reveals credentials, API keys, and business logic. Checking for `.git` exposure is a standard recon step.
About the eWPTX Practice Questions
Verified exam format metadata for eWPTX Web Application Penetration Tester eXtreme (eWPTXv3) is pending. The practice questions above remain available while official exam length, timing, passing score, fee, and administrator details are reviewed.