GWEB — GIAC Web Application Penetration Tester
GIAC's web application penetration testing certification and the DoD 8140 approved option in the web app security space. Covers the full web application testing methodology including authentication, injection, XSS, CSRF, API testing, and web service vulnerabilities. The MCQ format is a significant weakness compared to BSCP or OSWE — it validates knowledge of techniques rather than the ability to execute them. DoD 8140 approval is the primary differentiator that keeps GWEB relevant despite the practical format limitations. For government and contractor roles requiring DoD-approved web application security certification, GWEB is the standard option.
| Issuer | GIAC / SANS Institute |
|---|
| Level | intermediate |
|---|
| Domains | Application Security |
|---|
| Practical weight | 25% |
|---|
| Cost (USD) | 999 |
|---|
| Renewal | 4 years |
|---|
| DoD 8140 | Yes |
|---|
| Skills | web_application_recon, authentication_attacks, sql_injection, xss, csrf, file_upload_attacks, web_service_testing, api_security_testing, burp_suite_usage |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap