The GIAC Web Application Penetration Tester (GWAPT) certification tests whether you can find and prove web application flaws methodically, and candidates who only know tool output, not the reasoning behind each test, find the exam harder than expected. GWAPT covers reconnaissance and mapping, configuration testing, authentication and session management, injection and client-side attacks, and the tooling that ties a web test together. This guide sets out what GIAC publishes about the exam, objectives, prices, attempt rules and renewal, then adds a practical preparation plan and where GWAPT sits on an application security career path. It is for penetration testers, application security engineers and developers moving into testing, and for managers deciding whether to fund it. Exam facts are taken from giac.org, checked November 2026; GIAC says the format and passing score for your own attempt are shown in your GIAC account, so confirm there before you register. For the testing discipline itself, see the Web Application Security Testing Guide.
This is an independent guide from NHI Mgmt Group, based on GIAC's public certification pages as of November 2026. It is not sponsored or reviewed by GIAC. Exam details change, so confirm them against GIAC's current pages and your GIAC account.
Key takeaways
- It is a web testing methodology certification. The eight GIAC objectives run from web application fundamentals and reconnaissance through authentication, session, SQL injection and client-side attacks to testing tools.
- The exam is 82 questions in 3 hours. One proctored exam, minimum passing score 71%, taken remotely through ProctorU or at a Pearson VUE test centre.
- Open book rewards a good index. GIAC exams allow printed books and notes but no digital materials, so a well-built index matters as much as the reading.
- Budget $999 an attempt. That is GIAC's standard attempt price; practice tests are $399 and a retake is $899, and GIAC states prices can change without notice.
- Renew every four years. Earn 36 CPEs over four years and pay the renewal fee ($499 standard), or renew by retaking the exam.
Who the certification is for
GIAC lists the GWAPT audience as security practitioners, penetration testers, ethical hackers, web application developers, and website designers and architects. In practice it suits people who already understand HTTP and want to test web applications under authorisation in a structured, repeatable way, and developers who want to see their own code through a tester's eyes.
| Role | Why GWAPT fits | What to add |
|---|---|---|
| Junior or mid-level penetration tester | Formalises a web test methodology from mapping to reporting | Network and infrastructure testing (see the GIAC GPEN Guide) |
| Application security engineer | Shows how authentication, session and injection flaws are found and confirmed | Secure design and code review skills |
| Web developer or architect | Explains how attackers read your application, so you build controls in | Secure coding standards and threat modelling |
| Security consultant | A recognised credential for web testing engagements | Scoping and rules of engagement practice |
| Bug bounty or internal red team member | Broad coverage of common web flaw classes | API testing depth |
All testing practice must be on systems you own or are explicitly authorised to test. The Penetration Test Scoping Checklist covers how authorisation and scope are set on real engagements.
Exam format and domains
GIAC publishes the following for GWAPT (checked November 2026):
| Item | GIAC's published value |
|---|---|
| Number of exams | 1 proctored exam |
| Questions | 82 |
| Time limit | 3 hours |
| Minimum passing score | 71% |
| Delivery | Web based, proctored remotely (ProctorU) or onsite (Pearson VUE) |
| Attempt window | 120 days from activation |
| Materials allowed | Printed books, notes and study guides; no digital materials |
GIAC's certification objectives for GWAPT, with what each one means for study:
| GIAC objective | What GIAC says it covers | Study focus |
|---|---|---|
| Web Application Overview | Technologies, languages and structures such as HTTP, HTTPS and AJAX, in a security context | HTTP methods, headers, status codes, cookies, same-origin behaviour |
| Reconnaissance and Mapping | Discovery of a site and its features: port scanning, services and configuration, spidering, application flow charting, session analysis | Building a site map and an attack surface list before testing |
| Web Application Configuration Testing | Auditing for design or implementation flaws in configuration | TLS settings, default content, verbose errors, HTTP method handling |
| Web Application Authentication Attacks | How authentication works, user enumeration, bypassing or exploiting weak authentication | Login flows, password reset, multi-factor bypass logic, account lockout |
| Web Application Session Management | How sessions are tracked, how SSL/TLS is used, attacks on session state | Token randomness, fixation, cookie flags, logout and expiry |
| Web Application SQL Injection Attacks | Auditing and testing for SQL injection | Error based, blind and time based detection, and how parameterisation prevents it |
| Cross Site Request Forgery, Cross Site Scripting, and Client Injection Attacks | Understanding these attacks and the tools and techniques to find them | Reflected, stored and DOM XSS; CSRF token checks; output encoding |
| Web Application Testing Tools | Tools for testing modern applications including JavaScript and AJAX: proxies, fuzzing, scripting, attacking application logic | Intercepting proxy workflow, fuzzing inputs, simple scripting, business logic tests |
Each objective maps to a defensive topic on this site: the SQL Injection Prevention Guide, the Cross-Site Scripting (XSS) Prevention Guide, the CSRF Prevention Guide and the Session Fixation Guide. Reading the prevention side makes the testing side easier to remember, and it is what you will put in your findings.
Prerequisites and experience
The GIAC GWAPT page lists no formal prerequisite. GIAC links the exam to SANS training, which it says is available live and OnDemand. The affiliated course is SANS SEC542: Web App Penetration Testing and Ethical Hacking, which SANS lists as 6 days instructor-led or 36 hours self-paced, 36 CPEs, with basic Linux command-line skills as a prerequisite and SEC504, SEC560 and SEC565 as suggested earlier courses. Training is optional: you can buy a GIAC attempt without the course.
- Helpful before you start: comfort reading raw HTTP requests and responses, basic Linux shell use, some scripting (Python or similar), and an understanding of how a typical web stack handles sessions and databases.
- Helpful but not essential: experience building a web application, which makes authentication and session objectives much easier.
- If you are new to security: a foundation credential first is reasonable; the GIAC GSEC Guide covers GIAC's broad entry point.
Preparation plan
GIAC's practitioner preparation advice is to plan about four months of study starting straight after training, and it reports that certification holders studied an average of 55+ hours. A 12 week plan that fits that window:
- Weeks 1 to 2, fundamentals: HTTP, TLS, cookies, same-origin behaviour and the overview objective. Set up a local lab with an intentionally vulnerable training application and an intercepting proxy. Keep the lab isolated from production networks.
- Weeks 3 to 4, reconnaissance and configuration: map a lab application end to end, record every entry point, and test configuration settings. Use the OWASP WSTG Guide as a test case list.
- Weeks 5 to 6, authentication and sessions: work through login, reset, lockout and session handling in the lab; write a short note per test explaining what a pass and a fail look like.
- Weeks 7 to 8, injection and client-side: SQL injection detection techniques, XSS types and CSRF, always ending with the fix.
- Week 9, first practice test: GIAC advises a practice test after the first full pass through the material, then using the score report to find weak objectives.
- Weeks 10 to 11, index and gaps: finish your colour-coded index and revise weak objectives. GIAC's tip is not to take two practice tests in one day.
- Week 12, second practice test and booking: take the second practice test when the index is complete, then book the exam.
GIAC notes that the practice test question bank is limited, so questions may repeat across practice tests, and practice exams never contain real exam questions. A second identical score therefore says less than the first.
Readiness signals: you can explain, without notes, how each objective's main test works and what evidence proves a finding; your index finds any topic in under a minute; and your practice score is comfortably above 71% with no objective badly behind the rest. If one objective trails, spend a week in the lab on it before booking, because the exam spreads questions across all eight areas.
Cost, renewal and continuing education
| Fee (GIAC standard pricing, USD, excluding tax) | Amount |
|---|---|
| Certification attempt | $999 |
| Practice exam | $399 |
| Exam retake | $899 |
| Attempt extension (45 days) | $479 |
| Certification renewal | $499 |
| Additional renewals within 2 years of a full price renewal | $249 each |
| Reseating fee for a missed proctored appointment | $175 |
GWAPT is not listed among the exceptions on GIAC's pricing page, so the standard prices apply. GIAC states it can change pricing at any time without notice.
- Attempt rules: 120 days per attempt; total time including extensions and retakes cannot exceed 570 days; a 30 day wait applies after a failure, and a retake extends the deadline by 60 days; up to 10 extensions of 45 days each; after 3 failed attempts you must wait one year before a new attempt.
- Renewal: GIAC certifications stay active for four years. Renew by collecting 36 CPEs over four years and paying the renewal fee, or by retaking the exam; a successful renewal adds four more years. See the Certification Renewal and CPE Requirements Guide for planning CPEs.
Where it fits on the career path
GWAPT sits at the practitioner level for web application testing. It pairs naturally with GIAC's infrastructure testing credential for consultants who test both networks and applications, and with secure development work for application security engineers. The Penetration Tester Career Guide covers the wider route from first role to senior tester.
- Entry to testing: fundamentals, then GWAPT as a first specialist credential for testers whose work is mostly web.
- Consultant breadth: GWAPT plus GPEN covers the two most common engagement types.
- Application security engineering: GWAPT plus secure design and code review experience supports moving into a product security team.
- Identity angle: many web findings are identity findings: weak session handling, exposed API keys in front-end code, over-scoped tokens. The Token and Session Security Guide is useful context.
Salary claims are not included: GIAC publishes no official salary data for GWAPT, and figures quoted elsewhere vary by market and source.
Practitioner checklist
- Confirm the exam version, question count and passing score in your GIAC account before booking.
- Map your current skills to the eight GIAC objectives and mark the weakest three.
- Build a local lab with an intentionally vulnerable application and an intercepting proxy; never practise on systems you are not authorised to test.
- For every test you learn, write down the matching fix, so findings read well.
- Build your own colour-coded index as you study, not at the end.
- Take the first practice test after one full pass and the second only when the index is complete.
- Choose remote or test centre delivery early and test the remote setup.
- Diary the four-year renewal and track CPEs from the day you pass.
Standards and references
- GIAC: Web Application Penetration Tester (GWAPT)
- GIAC: Pricing
- GIAC: Retakes and Extensions
- GIAC: Best Practices for Practitioner Exam Preparation
- GIAC: How to Renew
- SANS: SEC542 Web App Penetration Testing and Ethical Hacking
Related NHI Mgmt Group resources: Web Application Security Testing Guide · OWASP WSTG Guide · GIAC GPEN Guide · Penetration Tester Career Guide · Web Application Attacks Guide