Web Application Penetration Tester
Prove you can break real web apps end-to-end.
About this exam
The foundational offensive-web credential. You'll be dropped into a set of live, vulnerable web surfaces and must find and exploit injection, access-control, and client-side flaws — then submit the flag each exploit yields. No multiple choice. No walkthroughs.
Skills verified
How the exam works
- 1Start when you're ready
The clock starts the moment you begin and keeps running even if you close the tab — there's no pause.
- 2Capture 6 of 8 labs
Open each lab, exploit it, and submit the flag it gives you. Solve any 6 within the 4-hour limit to pass.
- 3Proctored for integrity
Leaving the exam tab is recorded and factored into an integrity score printed on your credential — the pass has to mean something.
- 4Earn a verifiable credential
Pass and we mint a signed credential with a public verify page and a shareable certificate — provable, not self-reported. Plus +500 XP.
- 5Miss it? Cooldown, then retry
If you don't reach the threshold, a short cooldown applies before you can retake — so the credential stays meaningful.
Exam labs (8)
Solve any 6 of these 8 to pass. Once you start, the clock runs even if you close the tab.