eWAPT v3 Review
It's very hard to review the course because quite honestly, there are highs and lows, like any course. I'm going to flip the review aroundand start with what I see as the negatives. There are a few but I'm not trying to bash the course as I did enjoy it, I just want to be 100% honest so people know exactly what to expect.
1) Getting replies in the forum - often you'll see unanswered posts. Or people told to look in the FAQ if they ever get a reply. To me, if something is being asked so many times, it hints that there may be a problem with the current setup. And as paying members/customers, we should always get a reply. During the exam I had a query and it took 3 days of the alloted 7 to get a reply from tech support. That's not good. At all.
2) The setup - VPN'ing is a bit of a nightmare. You've got to mess with hosts files, resolver files, have multiple different VPN configs for different labs. It took me a good few hours of lab time to figure out the ropes.
3) The challenges - you never get to find out what the answer was. I completed all challenges so this doesn't apply to me per se, but I can imagine people who paid to learn this stuff then never finding out how it should be done, this might be annoying.
4) Exam - Can you pass the exam with just the material given? Hmmm.... at a push, yes. The real issue here is that the material comprises of 2,344 slides. That is a mammoth amount of slides. I'll come back to this in my positives. The main negative is that eLearnSecurity can take up to 30 days to mark your exam and give you the result. At the time of writing, I have been waiting approx 4 working days. I feel like 3 days is pushing it, but 30?! I understand a lot of people may take the course, but this is a seriously long time to wait. Your heart is in your mouth whilst you await the news. Do I need to resit? Did I do enough? Oh god I've spotted a spelling error in my report ...will I fail?
So, how did I find the course? Overall, I enjoyed it. The materials were extensive. There are videos to explain each topic and these pave the way for the labs. The labs are all practical and will have you doing something relevant to the chapter. So if you're reading about SQL injection, then you can bet that they're going to give you a lab based on what you've just learned.
Personally, I had no issues with any of the labs. The only one I got stuck on was an authentication lab, which was more because there were approx 5 levels, each one getting slightly more difficult until my brain just simply gave up. When I took a break and returned to it, I figured it out.
The amount of course material, in my humble opinion is TOO much. But this is the positive section! Yes, I know. To some people including myself, this is a huge positive because you get a lot of content explained at a low level which helps your understanding. The slight problem is when the exam hits and like me, you're trying to skim,-read 2000+ slides. During the exam I was frantically referring back to my notes, videos, slides. The final exam is a practical exam. You get 7 days to perform a penetration test and then 7 more days to write up the report.
I don't care what anyone says - the exam is rough. It's not a capture the flag. It's not a "prove there's a vulnerability and you're good"....no, you've got to exploit things fully to earn your points. How many points or things do you need to exploit? No one knows. eLearnSecurity don't tell you. And that's a good thing and a bad thing. It's good because it forces you to keep going in the same way Offensive Security force you to keep going. It's bad because you can't gauge if you've done enough. I've heard rumors saying you only need to do X, Y and Z to pass. And I've heard rumors saying X, Y and Z will fail. And then you can fail if your report isn't up to scratch.
I think anyone who has taken the exam will be honest enough to admit it's definitely not a beginner exam for sure. It took me 4 days to get admin access and then 1 day to write the report. 5/14 days used. Your OSCP isn't really useful here. This is a webapp course based on the materials they've taught throughout. WAPT v3 could definitely be the next OSCP, perhaps they already are. But I think they'll have to keep updating the material to remain leaders in the webapp security exam space. The plus side is that the course IS practical. No guessing multiple choice answers and 25% chances of getting it right.
Do I recommend the course? I do. But I feel like the course and setup needs some polishing.
Either way, it's a good course overall despite it having some flaws. Good luck to anyone who attempts this one next!
