How to Prepare for WAHS: A Web Hacking Practice Plan

WAHS is a 6-hour practical exam, so the preparation is mostly doing. This plan assumes about 8 hours a week. No plan guarantees a pass, and exam details can change, so check EC-Council's WAHS page (read November 5, 2026). Practice only on deliberately vulnerable applications you set up yourself.

Before Week 1

Set up a virtual machine with Burp Suite and a deliberately vulnerable web application, as described in our home lab guide. Start a notes file: one section per vulnerability, with the request, the payload and the result.

Week 1: Mapping and Enumeration

Learn to map an application: pages, parameters, hidden directories and technologies. Practice with Burp Suite and Nmap.

Week 2: Injection

Work through SQL injection and command injection by hand first, then with tools. Our SQL injection guide is the starting point.

Week 3: Cross-Site Scripting and Request Forgery

Practice reflected, stored and DOM-based XSS, then CSRF. See XSS explained. Note how each flaw differs in where the input lands.

Week 4: Access Control and Authentication

• Test IDOR, broken access control, session handling and weak authentication.
• Try cookie and header manipulation and session fixation.
• Review JWT security.

Week 5: Files, SSRF and Escalation

Practice file upload and inclusion flaws, SSRF and privilege escalation after a foothold. Read privilege escalation explained.

Week 6: Timed Drills

• Run a full 6-hour session against a practice application with a timer.
• Take a short break each hour and write down what is done and what is next.
• After the session, review where you lost time.
• Rest the day before the exam.

Common Mistakes

• Relying on scanners and skipping manual testing, which the exam rewards.
• Staying on one flaw for hours instead of moving on and coming back.
• Not keeping notes, so you repeat work.