eWPTv2 Exam Blueprint

Alex's Exam Readiness Map

A narrative-aligned blueprint showing how Alex threads reconnaissance, exploitation, and mitigation across the eWPTv2 subject matter. Jump straight into the modules that map to the exam's hands-on tasks.

Back to course hub

Recon & Surface Mapping

Core

Alex charts DNS, subdomains, and hidden paths before tackling APIs, GraphQL endpoints, and WebSocket backchannels.

Subdomain enumDir bustingTech fingerprinting

Authentication & Session Hardening

Core

Modern auth flows meet adversarial testing: JWT key confusion, OAuth/OIDC parameter tampering, cookie integrity, and session fixation defenses.

JWT/OAuthSession fixationCORS/CSP

Injection Surfaces

Core

From SQL/NoSQL to OS command and server-side template injection, Alex validates input handling and executes safe exploitation chains.

SQLi & NoSQLiCommand injectionSSTI

File, SSRF, and Deserialization

Core

Abuse upload pipelines, pivot with SSRF into cloud metadata, and break unsafe serializers while proposing hardened parsing paths.

File uploadSSRFXXE

Client-Side & Real-Time

Core

DOM and stored XSS, clickjacking, and WebSocket message tampering remain staples. Alex keeps browser exploits disciplined and documented.

XSSClickjackingWebSockets

Transport & Caching Edge Cases

Core

HTTP/1.1 and HTTP/2 quirks, smuggling, and cache poisoning scenarios help Alex uncover desync flaws before red-team rivals do.

Request smugglingCache poisoningHeader injections

Curriculum Roadmap

Upcoming modules to round out eWPTv2 coverage while keeping Alex's story arc.

Planned & In Design

SSTI & Template Engines

Planned

Exploit Jinja2/Handlebars contexts, pivot to RCE, and recommend sandboxing + allowlists.

SSRF & Cloud Metadata

Planned

Target internal services, metadata endpoints, and hardened outbound egress paths.

GraphQL Deep Dive

In design

Schema reconnaissance, query batching abuse, and authorization bypass testing.

JWT/OAuth Validation

In design

kid header confusion, algorithm downgrade, nonce/state integrity, and token expiry hygiene.

Request Smuggling Labs

Planned

Practical CL.TE/TE.CL chains with cache poisoning follow-ups and mitigation patterns.