The closest thing to sitting the real CWAP.
An exam simulation is a large, believable application that hides the entire syllabus across ordinary-looking features — auth, tickets, billing, admin, an API. Nothing is labelled, and there are no flags handed to you: your deliverable is a set of findings you discover and report, exactly like the real 24-hour exam.
- Recon & map first (Module 01). Fingerprint the stack, do content discovery, read the JavaScript, mine parameters, enumerate roles. Build a written attack map of endpoints, params and the role model. Do not spray payloads yet — you can’t exploit what you haven’t found.
- Hold multiple sessions. Create low-priv and higher-priv accounts up front so you can replay one role’s request as another (access control & logic depend on it).
- Sweep the easy wins (L1) breadth-first. Walk your map and run each class’s check: swap IDs (IDOR/BAC), probe reflection contexts (XSS), decode & tamper the token (JWT), grep JS / try
.git,.env,backups (secrets), test state-changes for CSRF, look for URL-fetch sinks (SSRF), tamper price/quantity/coupons (logic). Capture every quick finding before going deep.
- Chain for the hard ones (L2 — Module 10). Treat every finding as a pivot and ask “what did this give me, and what does that unlock?”. Classic chains: info-leak → IDOR → account takeover; SSRF → cloud metadata → internal; weak-JWT + enumerated admin id → forge admin; CSRF → change-email → reset → takeover. Two mediums often multiply into a critical.
- Track & prove. Log every finding with what it provides and what it requires — that’s how chains reveal themselves. Prove impact, not just presence: a secret is only a finding once you show what it unlocks.
- Manage time. Sweep wide for the guaranteed L1s first, then invest the back half of the clock building chains from your notes.
This maps 1:1 to the platform: learn each class in the Module Labs, drill it in the Practice Packs, then prove the whole thing here.