Check Point CCPE-W Web Hacking Certification Preparation
This hands-on course teaches you to find and exploit web application vulnerabilities, from the HTTP protocol all the way to deserialisation flaws, in an online lab packed with challenges. It maps to the Web Hacking course of Check Point's HackingPoint programme, built with NotSoSecure, and prepares you for the Check Point Certified PenTesting Expert – Web (CCPE-W) accreditation, exam 156-403. Sessions run live online, in person in Casablanca or on-site at your organization, in French or English. Each vulnerability is first explained, then exploited in the lab, then discussed from the fix side.
The essentials
Publisher : Check Point
Certification : Check Point Certified PenTesting Expert – Web (CCPE-W)
Exam code : 156-403
Duration : Duration on request
Level : Intermediate
Formats : Live virtual class · In-person in Casablanca · On-site (intra-company)
Languages : French or English
Exam facts : Exam 156-403 · Pearson VUE · in English
Exam voucher: included or optional depending on the package — contact us.
Understand HTTP and intercept traffic with a proxy tool
Enumerate an application and map its attack surface
Bypass authentication, password reset and authorisation controls
Exploit XSS, CSRF, SQL injection and XXE
Abuse file uploads, deserialisation and vulnerable components
Spot SSL/TLS misconfigurations and logging gaps
Suggest practical fixes to developers
Program
HTTP basics and proxy tools
Requests, responses, sessions
Interception
Enumeration and attack surface
Content discovery
Mapping features
Authentication and authorisation
Authentication attacks
Password reset flaws
Authorisation bypass
Client-side attacks
Cross-site scripting (XSS)
Cross-site request forgery (CSRF)
Open redirects
Injection attacks
SQL injection
XML External Entity (XXE)
Formula injection
Files, deserialisation and components
Insecure file uploads
Deserialisation
Components with known vulnerabilities
Configuration and monitoring
SSL/TLS misconfiguration
Insufficient logging and monitoring
Prerequisites
Basic networking and web application knowledge
Windows computer (native or virtual machine) with administrator rights
Target audience
Security-minded web developers
System administrators and SOC analysts
Junior penetration testers and people moving into offensive security
The exam
The CCPE-W accreditation is earned by passing Check Point exam 156-403, offered in English by Pearson VUE. You can sit it whenever you like after the course, independently of the session. CCPE-W is one of the HackingPoint courses in the Check Point certification programme. To succeed, redo the lab challenges and make yourself explain, for each flaw, its root cause, how it is exploited and how it is fixed.
Preparation tips
Get fluent with your interception proxy before tackling injections
Map each vulnerability to its OWASP Top 10 category
Redo the challenges without looking at the solutions
Frequently asked questions (FAQ)
Do I need to be a developer for Web Hacking?
No, but being able to read some HTML, JavaScript and SQL helps a lot. The course starts from HTTP basics and builds up step by step, so testers, administrators and developers can all follow. Developers usually find it changes the way they write and review code.
What is the CCPE-W exam code?
It is 156-403, taken with Pearson VUE in English. You can book it whenever you feel ready after the course.
Does the course follow the OWASP Top 10?
It covers the main vulnerability families you find there, such as injection, XSS and broken authorisation, and goes further with deserialisation, XXE and formula injection.
CCPE-W or CCPE-I: which first?
It depends on your scope: web applications for CCPE-W, systems and networks for CCPE-I. The two are independent.
Which formats and how long?
Live online, in person in Casablanca or on-site at your organization, in French or English. The length is set on request depending on the format and the team's level.