GWAPT
GIAC Web Application Penetration Tester · GIAC
The GWAPT validates a methodical approach to web application penetration testing: reconnaissance and mapping, configuration testing, authentication and session management, injection, cross-site scripting and request forgery. It is respected and recognised by the US DoD, but, unlike the GPEN, it is not ANAB-accredited. Its strength is a rigorous methodology useful for testers and developers alike; its limit is that it does not prove, as a fully practical exam would, that you can find flaws on your own.
- Exam
- 82 questions in 3 h, pass mark 71%. Open book (paper only), with hands-on CyberLive questions in a virtual machine. Taken remotely (ProctorU) or in a Pearson VUE centre.
- Exam price
- $999Same price with or without SANS training. The associated SANS course (SEC542) costs about US$8,780.
- Required experience
- No formal prerequisite. Knowing HTTP, web development and the main web vulnerabilities is strongly advised.
- Validity and maintenance
- Valid 4 years. Renew with 36 CPE credits over the period and a US$499 fee (US$249 for each further renewal registered within two years of the first), or by passing the current exam again.
- Format
- Multiple choice and hands-on
- Recognition
- DoD 8140 approved
Who is it for?
Web penetration testers, AppSec engineers and developers who want to master web attack techniques to better defend their applications.
Domains covered
- Web application architecture and testing tools
- Reconnaissance and mapping
- Configuration testing
- Authentication attacks
- Session management
- SQL injection
- XSS, CSRF and client-side injection
Nestor’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
