eLearningSecurity Advanced Web Application Penetration Tester (eWPTX) Review
I have recently completed eLearnSecurity’s Web Application Penetration Testing eXtreme course and wanted to share my experiences.
Before taking this course I completed OSCP before, but I felt that the OSCP really lacks the depth in web application security. This was the reason that I searched for a completly web application security focused course which can be attended online and is cost-efficient (meaning it is not $5000 such as the SANS courses).
I found the Elearnsecurity’s Web Application Penetration Testing Extreme course fulfills these criteria well (The only con I found about the training that the course material gets updated rarely).
First, it shows you wide range vulnerability types (XSS, XML, SQL injection, CSRF, HTML5, etc.) with comprehensive materials to understand them, to test for them, and to exploit them with real world examples (meaning you won’t test for alert(’XSS’) and likes).
What makes the difference between this course and the WAPT (it’s prequel course), that in this course you learn much about evasion techniques (evading regexp filtering, WAF, etc) and more there are more in-depth techniques as well.
Although the course is quite comprehensive, there is still much you can learn outside of it, you have to research and explore several things, because many times there are directions and reference materials but not complete solutions. This means that you can never use tools out of the box such as running a simple sqlmap scan in the labs. You have modify a lot of things with sqlmap or write a wrapper script to feed it to sqlmap in order to exploit an sql injection. It’s quite different from Offensive Security’s OSCP „Try harder” approach, such as there is a student forum where you can get good and fast help if you need it.
Of course there are labs and an exam as well. The labs aims to have you practice the techniques which was gathered in the course materials, because of this, they are quite simple. Their main purpose to have you understand how the technique works, but nothing more. It’s different from the OSCP labs where you just have to hack all the servers in the lab environment.
I found the the exam much more interesting. It simulates a penetration testing assessment, you get the scope, objective, and 7 days of lab time to find ALL vulnerabilites on the site and then another 7 days to write a report. And you really have to find all vulnerabilites, if you forgot to write down the simpliest CSRF attack in your report then you fail. However this works without the intent to make people fail the exam, because there is a free retake, and you get feedback what kind of vulnerabilities you missed during your first time.
What I really liked in the exam, that you have enough time to research to make your exploits work during the assessment (For example I read some chapters from security related books to understand, why my attacks does not work). Opposite the OSCP exam where time is really tight, because you have only 24 hours to test, this really makes your work easier, and you can improve during the exam as well.
All in all I recommend this course to those who are interested in web security. After taking the course I understands the techniques taught much better then before. One thing for sure, my next course will be an Elearnsecurity training as well.
