Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a certification for Web Application Security and Web Pen Testing. Via Google I found the following two:

How well is there reputation? Are there other ones? How difficult are they? What is needed for preparation?

share|improve this question

I've not done the GIAC one, but I have got the CREST Web Application Tester certification, so I can comment on that.

  • I'd say it's pretty well regarded, specifically in the UK penetration testing/ethical hacking industry. The CESG equivalency that @RoryAlsop mentioned is important for government work in the UK and it's also regarded as a good indication of a candidates skill match for UK testing companies (as several of the larger ones helped to design it).

  • As I mentioned on another question recently, I reckon that the CREST exam is the hardest professional exam I've taken. To put that in context I've done ~30 professional exams across IT and security over the last 15 years. It's got a tight time constraint and requires practical knowledge as well as theoretical knowledge to pass.

  • Preparing for it can be tricky as (as far as I know) there's no specific training course you can take. Personally I wouldn't recommend trying it unless you're an active web app. tester. If you are going to take it then review the syllabus that's available on their site and make sure you're comfortable with all the areas it mentions. Also I'd recommend reviewing the Web App Hackers Handbook, and ensuring you're comfortable with the various areas that it describes.

share|improve this answer

You might want to see the following questions on this site: Professional certifications for IT Security and International pentester certification. They give some partial information about various certifications, even if it is not necessarily everything you are looking for.

share|improve this answer

There aren't a huge number of certs around, especially if you are looking internationally.

First off, have a look at the International link in D.W's answer.

Personally, I think the two you have found have the highest reputation in the UK, but you could also look at the Tiger Scheme for another perspective. Like CREST it holds CHECK equivalency from CESG, the National Technical Authority for Information Assurance in the UK.

share|improve this answer

and you can wait for the this one offsec web expert

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.