EC-Council WAHS: Exam Format, Levels and What You Practice

Web Application Hacking and Security (WAHS) from EC-Council is a fully hands-on certification for people who test web applications. These details come from EC-Council's WAHS page, read on November 5, 2026. EC-Council changes its rules and fees, so confirm current terms before you register.

Exam Format

• Format: a fully online, remotely proctored, performance-based exam.
• Duration: 6 hours.
• Scope: the OWASP Top 10 and manual exploitation, not only automated tools.
• Window: the exam dashboard is available for 30 days, and you must schedule and finish within that time.
• What you need: a host machine running a virtual machine with your own testing toolkit.

Three Levels

• Above 60%: Certified Web Application Security Associate.
• Above 75%: Certified Web Application Professional.
• Above 90%: Certified Web Application Expert.

Eligibility

EC-Council does not state a prerequisite. Web basics, Linux and a working knowledge of Burp Suite will help.

What You Practice

EC-Council lists, among others, advanced SQL injection, reflected, stored and DOM-based cross-site scripting, CSRF, SSRF, broken access control, file inclusion and upload flaws, command injection, session fixation, clickjacking and privilege escalation. Read our guides on SQL injection, XSS, SSRF and IDOR to get the basics.

Cost and What We Offer

Our WAHS fee is ₹34,000 + 18% GST (₹40,120 in total). Each EC-Council certification fee includes one exam attempt. The full table is on the WAHS certification page. Our Application Security course is web, API, Android and thick-client testing with Burp Suite, and is the best practice for a hands-on web exam.