EC-COUNCIL

EC-Council Web Application Hacking and Security

WAHS

EC-Council's Web Application Hacking and Security (WAHS) is a hands-on specialization certification that validates your ability to play, learn, hack, test, and secure web applications against existing and emerging threats. This performance-based program challenges you with progressively difficult, Capture-The-Flag style scenarios derived from EC-Council's iLabs, covering the OWASP Top 10 and advanced attack vectors. Earning the WAHS credential proves you can perform real-world web application security assessments under pressure.

Practice Free Questions

8Domains

25Objectives

206Practice pages

979Free questions

WAHS free practice questions

Choose any objective and open any question page — no sign-in required.

Privilege Escalation

39 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–39

Insecure Direct Object References (IDOR)

49 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–49

Parameter Tampering

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

API Abuse

63 questions · 13 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–60 61–63

CORS Misconfiguration

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–33

Advanced SQL Injection (SQLi)

42 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–42

Command Injection

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

Remote Code Execution (RCE)

46 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–46

Reflected XSS

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Stored XSS

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

DOM-based XSS

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Cross-Site Request Forgery (CSRF) - GET and POST Methods

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Server-Side Request Forgery (SSRF)

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

Weak SSL/TLS Ciphers

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Weak Cryptographic Algorithms or Protocols

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

HTTP Security Header Directives

34 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Security Misconfigurations

44 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–44

Directory Browsing and Bruteforcing

42 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–42

Clickjacking

38 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–38

Local File Inclusion (LFI)

17 questions · 4 pages

Questions 1–5 6–10 11–15 16–17

Remote File Inclusion (RFI)

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

Arbitrary File Upload and Download

30 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30

Authentication Bypass

75 questions · 15 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–50 51–55 56–60 61–65 66–70 71–75

Session Fixation

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Network Scanning and Reconnaissance

47 questions · 10 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–45 46–47

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (25 objectives · 206 pages).

EC-Council Web Application Hacking and Security

WAHS free practice questions

Domain 1 · Broken Access Control23% of practice bank · 5 objectives · 227 questions23%

Domain 2 · Injection Attacks12% of practice bank · 3 objectives · 119 questions12%

Domain 3 · Cross-Site Scripting (XSS)11% of practice bank · 3 objectives · 107 questions11%

Domain 4 · Request Forgery Attacks6% of practice bank · 2 objectives · 60 questions6%

Domain 5 · Cryptographic Failures and Transport Security11% of practice bank · 3 objectives · 111 questions11%

Domain 6 · Security Misconfiguration13% of practice bank · 3 objectives · 124 questions13%

Domain 7 · File Inclusion and Upload Attacks7% of practice bank · 3 objectives · 66 questions7%

Domain 8 · Authentication and Session Management17% of practice bank · 3 objectives · 165 questions17%