100+ Free PWPP Practice Questions
Prepare for the TCM Security Practical Web Pentest Professional exam with instant access — no signup required.
Loading practice questions...
Explore More TCM Security Practical Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Key Facts: PWPP Exam
$499
Exam Cost
TCM Security
3 days
Assessment Window
TCM Security
2 days
Report Submission Deadline
TCM Security
1 free
Retake Included
TCM Security
16+ hours
Included Course Content
TCM Security
Non-expiring
Credential Validity
TCM Security
The PWPP is TCM Security's practical web pentest certification targeting intermediate-advanced practitioners. The 3-day hands-on exam tests real-world exploitation skills: NoSQL injection, SSRF (including cloud metadata), SSTI (Jinja2/Twig/Freemarker), race conditions via Turbo Intruder, OAuth/JWT attack chains, mass assignment, WAF bypass, and vulnerability chaining. A professionally written report must be submitted within 2 days after the assessment. Cost is $499 including one free retake and 12 months of access to Practical Web Hacking and Practical API Hacking courses. No flags, no multiple-choice — pure real-world engagement.
Sample PWPP Practice Questions
Try these sample questions to test your PWPP exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.
1A web application uses MongoDB and constructs a login query as `db.users.find({username: req.body.username, password: req.body.password})`. An attacker submits `{"username": "admin", "password": {"$ne": null}}`. What type of attack is this?
2When testing a MongoDB application for NoSQL injection, which of the following payloads injected in a URL parameter is most likely to cause an authentication bypass via operator injection?
3An application endpoint processes JSON and is vulnerable to NoSQL injection. To extract data character-by-character from a MongoDB field using blind injection, which operator would an attacker use?
4A banking application transfers funds through a POST endpoint. Two simultaneous requests are sent to transfer the same $500 balance to different accounts. Both requests read the balance as $500 and proceed. This results in $1000 being transferred despite only $500 existing. What vulnerability class is this?
5Which Burp Suite feature is specifically designed to send multiple identical or crafted HTTP requests simultaneously to exploit race conditions?
6An application uses a single-use discount coupon system. After redeeming a coupon, the server marks it as used in the database. A tester submits 20 redemption requests simultaneously using Turbo Intruder. The coupon is applied 3 times before the 'used' flag is set. Which technique most effectively prevents this?
7A REST API uses a Node.js/Express framework and automatically binds all JSON body parameters directly to a Mongoose model: `User.create(req.body)`. An attacker sends `{"username": "attacker", "email": "a@b.com", "isAdmin": true}`. The `isAdmin` field is silently set. What vulnerability is this?
8During API testing, you discover a PUT /api/users/profile endpoint that accepts JSON. The API documentation only mentions `name`, `email`, and `bio` fields. Which Burp Suite technique best helps identify hidden mass-assignable parameters?
9A web application fetches a URL specified by the user: `fetch(req.body.url)`. An attacker submits `http://169.254.169.254/latest/meta-data/iam/security-credentials/`. The server returns AWS IAM credentials. What is this attack?
10An SSRF filter blocks requests to `169.254.169.254`. Which bypass technique most likely succeeds against a naive blocklist implementation?
About the PWPP Exam
The PWPP (Practical Web Pentest Professional) is TCM Security's intermediate-to-advanced hands-on web application penetration testing certification. Unlike multiple-choice exams, the PWPP is a real-world practical engagement: you have 3 days to exploit advanced web vulnerabilities in a lab environment and 2 additional days to deliver a professional penetration test report. This practice test covers the theoretical knowledge behind advanced techniques: NoSQL injection, race conditions, SSRF, SSTI, OAuth/JWT attack chains, WAF bypass, and vulnerability chaining.
Assessment
Performance-based assessment
Time Limit
3 days assessment + 2 days reporting
Passing Score
Successful exploitation + professional report
Exam Fee
$499 (TCM Security)
PWPP Exam Content Outline
Advanced OWASP Exploitation
Advanced OWASP Top 10 exploitation including second-order SQL injection, DOM-based XSS, business logic flaws, and vulnerability chaining for amplified business impact
Injection Attacks (NoSQL, SSTI, XXE)
NoSQL injection via MongoDB operator injection and $regex blind extraction; SSTI across Jinja2, Twig, Freemarker, and Handlebars with RCE chains; XXE with out-of-band exfiltration
Server-Side Request Forgery (SSRF)
Standard, blind, and cloud-metadata SSRF; DNS rebinding; headless browser SSRF via PDF generators; SSRF filter bypass via IP encoding, URL parsing tricks, and IPv6 notation
Authentication & API Attacks
OAuth 2.0 attack chains (redirect_uri, PKCE, implicit flow, state CSRF); JWT attacks (algorithm confusion, kid injection, JKU/JWK injection, embedded JWK); BOLA/BFLA per OWASP API Top 10 2023
Race Conditions & Business Logic
TOCTOU race conditions via Burp Turbo Intruder single-packet attacks; atomic operation requirements; business logic flaw identification and exploitation methodology
WAF Bypass & Filter Evasion
Comment-based SQL obfuscation, event-handler XSS bypasses, HTTP Parameter Pollution, Content-Type switching, URL/Unicode encoding bypass, and CSP nonce bypass techniques
Advanced Burp Suite Usage
Turbo Intruder race condition scripting, Param Miner for hidden parameter discovery, Active Scan++ for SSTI/SSRF, DOM Invader for DOM XSS, jwt_tool playbook scanning
Vulnerability Chaining & Professional Reporting
Chaining findings for amplified impact, CVSS v3.1 scoring accuracy, professional pentest report structure, PoC documentation, and critical-finding escalation protocols
How to Pass the PWPP Exam
What You Need to Know
- Passing score: Successful exploitation + professional report
- Assessment: Performance-based assessment
- Time limit: 3 days assessment + 2 days reporting
- Exam fee: $499
Keys to Passing
- Work through all 100 available questions
- Review every answer and explanation
- Track weak areas and revisit them
- Use our AI tutor for tough concepts
PWPP Study Tips from Top Performers
Frequently Asked Questions
What is the PWPP exam format?
The PWPP is a hands-on practical web application penetration test. You have 3 full days to exploit vulnerabilities in a lab environment and 2 additional days to write and submit a professional penetration test report. There are no flags, no multiple-choice questions, and no gotchas — the exam mirrors real-world pentest engagements with vulnerabilities that require knowledge, methodology, and troubleshooting to find and exploit.
What vulnerabilities are tested in the PWPP?
The PWPP covers advanced web vulnerabilities: NoSQL injection (MongoDB operator injection, blind $regex extraction), race conditions and TOCTOU vulnerabilities, mass assignment and parameter pollution, Server-Side Request Forgery (SSRF) including cloud metadata exploitation, Server-Side Template Injection (SSTI) in various template engines, OAuth 2.0 and JWT attack chains, advanced Burp Suite usage (Turbo Intruder, Param Miner), WAF bypass techniques, and vulnerability chaining to demonstrate amplified business impact.
What courses prepare for the PWPP?
TCM Security's Practical Web Hacking (10 hours) and Practical API Hacking (6 hours) courses are included with the PWPP exam purchase and contain all information required to pass. Both courses provide hands-on labs. Additional preparation resources include PortSwigger Web Security Academy (practitioner-level labs), real-world bug bounty practice, and review of the OWASP Testing Guide and OWASP API Security Top 10.
How hard is the PWPP compared to the PWPA?
The PWPP is significantly harder than the associate-level PWPA. While PWPA tests OWASP Top 10 fundamentals and basic Burp Suite usage, PWPP requires exploitation of more advanced vulnerabilities that scanners typically miss: NoSQL injection, race conditions, SSTI, advanced OAuth/JWT attacks, and WAF bypass techniques. Candidates should have the PWPA or equivalent practical experience before attempting the PWPP.
What does a professional PWPP report include?
A passing PWPP report should include: an executive summary, methodology overview, findings with CVSS v3.1 scores and CWE IDs, proof-of-concept screenshots and payloads, business impact descriptions for each finding, vulnerability chaining documentation where applicable, and remediation recommendations. TCM Security evaluates both the technical findings discovered and the quality of the written report — both are assessed.
Is this practice test like the real PWPP exam?
No — this is a multiple-choice knowledge-preparation test. The real PWPP is a hands-on practical exam where you must actually exploit web application vulnerabilities in a lab environment. This practice test helps you learn the concepts, tools, attack techniques, and methodology. To pass PWPP, you must practice hands-on exploitation: complete the included courses, work through PortSwigger labs, practice API hacking, and develop your own Burp Suite workflow.