PracticeVideosBlogFlashcardsEspañol
All Practice Exams

118+ Free eWPTX Practice Questions

Prepare for the eWPTX Web Application Penetration Tester eXtreme (eWPTXv3) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
118+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More INE Security (eLearnSecurity) Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

eJPT Junior Penetration Tester

Practice Questions

INE AI Systems Security Specialist (eAIS)

Practice Questions

INE eCDFP Certified Digital Forensics Professional

Practice Questions

INE eCPPT Certified Professional Penetration Tester

Practice Questions

INE eMAPT Mobile Application Penetration Tester

Practice Questions

INE eWPT Web Application Penetration Tester

Practice Questions
2026 Statistics

Key Facts: eWPTX Exam

18 hours

Exam Duration

INE Security

75%

Passing Score

INE Security

45

Exam Questions

INE Security

25%

API Security Weight

INE Security eWPTX curriculum

$400

Exam Voucher Cost

INE Security

3 years

Certification Validity

INE Security

The eWPTX (eWPTXv3) is INE Security's most advanced web app pentesting cert. The 18-hour non-proctored practical exam requires compromising a web application lab and answering 45 questions (75% to pass) tied to discovered vulnerabilities. API security (REST, GraphQL, OAuth) comprises 25% of the curriculum. Cost: $400 exam voucher / $600 with 3-month INE Premium. Valid 3 years. One free retake within 14 days of failure.

Sample eWPTX Practice Questions

Try these sample questions to test your eWPTX exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 118+ question experience with AI tutoring.

1Which HTTP method should an API penetration tester specifically test beyond GET and POST to check for unintended functionality exposure?
A.Only HEAD and OPTIONS
B.CONNECT and TRACE only
C.PUT, DELETE, PATCH, and OPTIONS
D.Only GET and POST matter for APIs
Explanation: REST APIs often expose PUT (update), DELETE (remove), PATCH (partial update), and OPTIONS (discover allowed methods) endpoints that may lack proper authorization checks. Testers must enumerate all supported HTTP methods on every endpoint, as developers may forget to restrict dangerous methods like DELETE or PUT on sensitive resources.
2During GraphQL API reconnaissance, which query allows an attacker to enumerate all available types, queries, mutations, and fields in the schema?
A.__schema { queryType { name } }
B.{ __typename }
C.{ __schema { types { name
D.query { schema { allFields } }
Explanation: GraphQL introspection via `{ __schema { types { name fields { name } } } }` returns the complete type system including all queries, mutations, subscriptions, and field definitions. This is the standard reconnaissance technique against GraphQL APIs; if introspection is enabled in production, attackers gain a full map of the API surface without any documentation.
3When testing OAuth 2.0 implementations, which vulnerability arises when the authorization server does not validate the `redirect_uri` parameter strictly?
A.Authorization code interception via open
B.CSRF on the authorization endpoint alone
C.OAuth access token replay after expiry
D.JWT RS256-to-HS256 algorithm confusion
Explanation: If an OAuth server accepts any `redirect_uri` without strict validation, an attacker can craft an authorization request pointing to an attacker-controlled URL. When the victim authorizes the request, the authorization code is delivered to the attacker's server, allowing the attacker to exchange it for an access token. This is one of the most critical OAuth vulnerabilities.
4An application uses a JWT signed with RS256. The attacker changes the `alg` header to `HS256` and signs the token with the server's RSA public key as the HMAC secret. What attack is this?
A.JWT key injection via jwk or jku header parameters
B.Algorithm confusion (alg:none) attack
C.RS256-to-HS256 algorithm confusion attack
D.JWT kid header parameter injection
Explanation: The RS256-to-HS256 confusion attack exploits JWT libraries that use the same code path for both algorithms. When the attacker downgrades the alg to HS256 and uses the public RSA key as the HMAC secret, a vulnerable library verifies the signature successfully because the public key is known to both parties. The server expects asymmetric verification but performs symmetric verification instead.
5Which tool is the primary industry-standard choice for automated and manual web application penetration testing, including API interception, repeating requests, and active scanning?
A.Burp Suite
B.Nmap
C.Metasploit Framework
D.Nikto
Explanation: Burp Suite is the de facto standard proxy and testing platform for web application penetration testing. It provides an intercepting proxy, Repeater for manual request modification, Intruder for fuzzing, Scanner for automated vulnerability detection, and extensions for API testing. Virtually all advanced web app and API testing workflows center on Burp Suite.
6During passive reconnaissance for a web application, which technique allows discovery of subdomains and SSL/TLS certificate information without sending any packets to the target?
A.Certificate Transparency log search via crt.sh
B.Active DNS brute-forcing with dnsrecon against authoritative servers
C.TCP SYN scanning with Nmap against the target
D.Directory brute-forcing with ffuf wordlists
Explanation: Certificate Transparency (CT) logs record every SSL/TLS certificate issued by trusted CAs. Querying crt.sh or similar CT log search engines reveals all subdomains for which certificates have been issued, entirely without sending traffic to the target. This makes it a pure passive recon technique that often uncovers hidden or forgotten subdomains.
7In a time-based blind SQL injection attack, which SQL function is commonly used in MySQL to introduce a deliberate delay to confirm injection?
A.SLEEP(5)
B.WAITFOR DELAY '0:0:5'
C.PG_SLEEP(5)
D.DBMS_PIPE.RECEIVE_MESSAGE('a',5)
Explanation: MySQL uses the `SLEEP(N)` function to introduce a delay of N seconds. In time-based blind SQLi, the attacker injects a condition like `1 AND SLEEP(5)` — if the response is delayed by 5 seconds, the injection is confirmed. Different databases have different delay functions: MSSQL uses WAITFOR DELAY, PostgreSQL uses PG_SLEEP, and Oracle uses DBMS_PIPE.RECEIVE_MESSAGE.
8Which SQLMap flag is used to enumerate all databases on a target with a confirmed SQL injection point?
A.--dbs
B.--dump-all
C.--tables
D.--schema
Explanation: The `--dbs` flag in SQLMap enumerates all available databases accessible through the injection point. The typical workflow is: first confirm injection, then use `--dbs` to list databases, `--tables -D <db>` to list tables, `--columns -T <table>` to list columns, and finally `--dump` to extract data.
9A NoSQL injection payload `{ "username": { "$ne": null }, "password": { "$ne": null } }` sent to a MongoDB login endpoint achieves what result?
A.Denial of service from malformed MongoDB operators
B.Bulk extraction of every username in the collection
C.Auth bypass matching the first doc where both
D.Insertion of a new administrator account document
Explanation: MongoDB's `$ne` (not equal) operator allows query operators to be injected where string values are expected. This payload translates to 'find a document where username is not null AND password is not null,' which matches the first valid user record and logs the attacker in as that user. This is the classic NoSQL authentication bypass.
10Which recon technique involves searching for exposed `.git` directories on web servers to recover source code and commit history?
A.Exposed .git enumeration with GitTools or git-dumper
B.Public GitHub repo search with Advanced Search
C.Harvesting commit emails from public GitLab user profiles
D.Cloning private repos with stolen SSH deploy keys
Explanation: When a `.git` directory is left accessible on a web server (e.g., https://target.com/.git/), tools like GitTools or git-dumper can download the raw git objects and reconstruct the full repository including source code, configuration files, and commit history. This often reveals credentials, API keys, and business logic. Checking for `.git` exposure is a standard recon step.

About the eWPTX Exam

The eWPTX (Web Application Penetration Tester eXtreme) is INE Security's most advanced web application penetration testing certification. The 18-hour practical exam requires candidates to conduct a comprehensive web application pentest against a live lab environment and answer 45 questions tied to their findings. With 25% of content focused on API security (REST, GraphQL, OAuth), the eWPTX reflects the modern threat landscape. This practice bank covers all 7 domains: methodology, reconnaissance, authentication attacks, injection vulnerabilities, API pentesting, server-side attacks, and WAF bypass.

Assessment

Performance-based assessment

Time Limit

18 hours (hands-on lab engagement)

Passing Score

75%

Exam Fee

$400-$600 (INE Security)

eWPTX Exam Content Outline

25%

API Penetration Testing

REST/GraphQL/SOAP API enumeration, BOLA/IDOR, mass assignment, BFLA, rate-limit bypass, OAuth 2.0 flaws, business logic testing, and OWASP API Security Top 10

15%

Authentication Attacks

JWT attacks (alg:none, RS256→HS256 confusion, kid header injection, secret cracking), OAuth 2.0/PKCE, SAML XML Signature Wrapping, CORS, session fixation, credential stuffing

15%

Injection Vulnerabilities

Error-based, blind, second-order, and OOB SQL injection; NoSQL injection ($ne, $where operators); LDAP injection; ORM/HQL injection; XXE; Content-Type confusion injection

15%

Web Application Reconnaissance

Certificate transparency (crt.sh), WHOIS/BGP/ASN lookup, Wayback Machine, Google dorking/GHDB, Shodan, directory fuzzing (ffuf, gobuster), JavaScript analysis (LinkFinder), git exposure

10%

Server-Side Attacks

SSRF (AWS IMDS, file://, IP encoding bypasses), Java/PHP insecure deserialization (ysoserial, gadget chains), SSTI (Jinja2 RCE chains), HTTP request smuggling, path traversal, LFI with PHP filters

10%

Filter Evasion & WAF Bypass

URL double-encoding, HTML entity encoding, comment injection (UN/**/ION), HTTP parameter pollution, chunked transfer encoding bypass, content-type manipulation, X-Forwarded-For spoofing, origin server discovery

10%

Web App Pentesting Methodology

Engagement scoping, rules of engagement, systematic testing workflow, CVSS risk rating, impact demonstration, Burp Suite/OWASP ZAP usage, professional report writing, ethical practices

How to Pass the eWPTX Exam

What You Need to Know

  • Passing score: 75%
  • Assessment: Performance-based assessment
  • Time limit: 18 hours (hands-on lab engagement)
  • Exam fee: $400-$600

Keys to Passing

  • Work through all 118 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

eWPTX Study Tips from Top Performers

1Master API security testing first — it comprises 25% of the exam and covers REST, GraphQL, OAuth 2.0, and modern authorization flaws
2Learn all JWT attack vectors: alg:none, RS256→HS256 algorithm confusion, kid header path traversal, and HMAC secret cracking with Hashcat
3Practice advanced SQL injection beyond basic UNION — focus on blind, second-order, and OOB techniques using SQLMap and manual methods
4Understand Java and PHP deserialization exploitation: ysoserial gadget chains for Java and PHP object injection via magic methods
5Build a methodology for API reconnaissance: OpenAPI/Swagger enumeration, parameter mining with Arjun, JavaScript analysis with LinkFinder
6Practice WAF bypass techniques: encoding (URL, HTML entities, Unicode), HTTP parameter pollution, comment injection, and chunked transfer encoding
7Use PortSwigger Web Security Academy labs to practice SSRF, HTTP request smuggling, SSTI, and deserialization exploitation hands-on
8Study OWASP API Security Top 10 (2023) thoroughly — BOLA, BFLA, mass assignment, and broken object property authorization are heavily tested
9Practice GraphQL-specific attacks: introspection enumeration with InQL, batching for rate-limit bypass, and depth-based DoS

Frequently Asked Questions

What is the eWPTX exam format?

The eWPTX is an 18-hour non-proctored practical exam where you conduct a web application penetration test against a live INE lab environment. You answer 45 questions (multiple choice and short answer) that are directly tied to vulnerabilities and findings in the lab. You need 75% (approximately 34 correct) to pass. You can use your notes, the official course materials, and online resources during the exam.

How much does the eWPTX cost?

The eWPTX exam voucher costs $400 USD. A bundle including 3 months of INE Premium access (which includes the Advanced Web Application Penetration Testing course) costs $600 USD. Vouchers expire 180 days after purchase. One free retake is included if you fail, but it must be taken within 14 days of your failed attempt.

What experience do I need for eWPTX?

The eWPTX requires advanced web application penetration testing experience. INE recommends completing the eWPT (Web Application Penetration Tester) certification first. You should be comfortable with Burp Suite, SQL injection, XSS, SSRF, and authentication testing before attempting eWPTX. The exam's 25% API security focus means solid REST API and GraphQL testing skills are essential.

What topics are most important for eWPTX?

API penetration testing (25%) is the largest domain: REST API testing, GraphQL introspection/batching, OAuth 2.0 vulnerabilities, BOLA/IDOR, mass assignment, and rate-limit bypass. Authentication attacks (15%) include JWT exploitation (alg:none, algorithm confusion, kid injection) and SAML XSW. Injection vulnerabilities (15%) cover advanced SQLi variants, NoSQL injection (MongoDB operators), and XXE. WAF bypass techniques (encoding, HPP, chunked encoding) are tested throughout.

Is eWPTX harder than eWPT?

Yes, eWPTX is significantly more advanced than eWPT. While eWPT covers foundational web application testing, eWPTX focuses on advanced techniques: JWT algorithm confusion attacks, SAML XML Signature Wrapping, GraphQL batching abuse, Java deserialization gadget chains, PHP SSTI chains to RCE, HTTP request smuggling, and advanced WAF bypass. The API security focus (25%) reflects modern enterprise attack surfaces not covered in depth by eWPT.

Is this practice test like the real eWPTX?

This is a knowledge-based multiple-choice practice bank. The real eWPTX is a hands-on practical lab where you must actively exploit web application vulnerabilities and answer questions based on your findings. This practice bank builds the theoretical knowledge foundation — understanding attack techniques, tools, and methodologies — that is essential for successfully conducting the practical lab assessment.