thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

GIAC · Cybersecurity · Professional

GIAC Web Application Penetration Tester (GWAPT) exam guide

Exam GWAPT

GIAC Web Application Penetration Tester (GWAPT) proves you can test web applications for authentication, session, injection, XSS and CSRF flaws using a structured methodology. Aligned with SANS SEC542, it suits pen testers specialising in web.

Questions82
Time limit180 minutes
Passing score71%
Exam feeSee official page
Valid for4 years
DeliveryRemote proctored (ProctorU) or Pearson VUE test center

Format: Proctored CyberLive exam with hands-on lab questions plus multiple choice; open book. Fee note: GIAC shows the price at checkout; attempts bundled with SANS training cost less than standalone attempts. Includes practice tests.

Who it's for

Penetration testers, application security engineers and developers who test web applications.

What the exam covers

Web Application Overview—
Reconnaissance and Mapping—
Web Application Configuration Testing—
Web Application Authentication Attacks—
Web Application Session Management—
Web Application SQL Injection Attacks—
Cross-Site Request Forgery, Cross-Site Scripting, and Client Injection Attacks—
Web Application Testing Tools—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: None.

Recommended: Web development or pen testing experience; SANS SEC542 is the aligned course.

Keeping it active

Valid four years: earn 36 CPEs in the cycle and pay GIAC's certification maintenance fee, or renew by retaking the current exam.

Skills & careers

Skills it validates

  • Mapping and spidering applications
  • Testing authentication and session handling
  • Exploiting SQL injection
  • Finding XSS and CSRF
  • Using Burp Suite effectively
  • Testing configuration weaknesses

Job roles

Web Application Penetration TesterApplication Security EngineerSecurity ConsultantBug Bounty HunterDevSecOps Engineer

Where it fits in your path

You are here

GIAC Web Application Penetration Tester (GWAPT)

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: HTTP, web architecture and recon.
  2. Week 2: Authentication and session attacks with Burp Suite.
  3. Week 3: SQL injection, XSS and CSRF labs.
  4. Week 4: Full lab replay and practice tests, then book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • GIAC exams are open book (printed notes only); build a tabbed index of your course books before the exam.
  • Be fluent in Burp Suite; CyberLive tasks expect you to use it.
  • Know manual SQL injection, not just sqlmap.
  • Read HTTP request/response snippets carefully; small header details decide answers.

Key terms for this exam

All 163 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

Pass mark?

71%.

GWAPT vs OSWE?

OSWE is a 48-hour white-box exploit-development exam; GWAPT is black-box web testing methodology.

Is GWAPT open book?

Yes.

Renewal?

Every four years with 36 CPEs.

Is it worth it?

Useful for web-focused pen testing roles, especially where GIAC is valued.

Official page: www.giac.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.