eJPT Exam Experience | Siyon Babu Rai

Introduction

Hey everyone. I’m writing this shortly after passing the eJPT exam. I started my attempt on July 3, 2026, at 12:45 PM and wrapped everything up by 7:30 PM on the dot. I’d been prepping for a few months, felt reasonably ready, and still had that specific kind of nervous energy right before clicking start. That feeling doesn’t really go away no matter how much you’ve practiced.

The Exam Experience

The setup drops you right into a browser-based Kali network with a list of questions. The best part about the eJPT format is that it isn’t a guessing game. Reading through all the questions first gives you immediate hints, pointing out what technologies are running and helping you plan your exact attack path.

From there, I went straight into scanning the network. The first part felt incredibly slow — just mapping out live targets using nmap, checking version numbers, and looking through web directories with gobuster. It always feels like you are stuck, but this groundwork is what makes the actual hacking possible. Just by digging into those open ports and shared folders, I managed to answer a large chunk of the exam questions before even launching an exploit.

Once I started finding footholds, things picked up fast. I caught an easy win on one system through an outdated service version that I recognized from my labs, using Metasploit to launch the attack. As I moved deeper, the biggest lesson I learned was that credentials travel. Cleartext passwords or usernames found on one system often unlocked services on a completely different machine using tools like Hydra. If you find a valid password, save it and try it everywhere.

The turning point came when I had to figure out how to get into the hidden network. After running out of targets on the main subnet, I checked the network settings on a compromised machine and found a second network card. I set up an internal pivot using Metasploit’s autoroute tool to route my traffic through that machine, which immediately exposed the second internal subnet containing the rest of the target systems.

When I finally hit submit at 7:30 PM, it was mostly relief, if I’m honest. Not some huge triumphant feeling — more like finally being able to exhale after holding my breath for nearly seven hours straight. A little bit of quiet pride crept in afterward too, mostly because I didn’t panic when things got slow or frustrating.

If you’re getting ready to sit this exam — you will hit a wall at some point, probably more than once. That’s not a bad sign. It’s just what the process actually looks like.

If you’ve taken the eJPT or are prepping for it, happy to chat in the comments!

Core Tools Checklist

If you want to pass this exam, you need to know how to use these tools seamlessly in your Kali terminal:

• Nmap: For initial subnet discovery, sweeping live hosts, and grabbing service banners.
• Gobuster / Dirb / Nikto: For fuzzing directories and finding hidden files or login panels on web servers.
• Metasploit Framework (msfconsole): Essential for searching modules, selecting payloads, setting up multi-handlers, and using post-exploitation scripts.
• Hydra: For automated brute-forcing against protocol logins like SSH, FTP, RDP, or SMB when you have a list of targets.
• WPScan: Specifically for scanning and enumerating users or plugins on WordPress instances.
• CrackMapExec / Netexec: Incredibly useful for quickly checking credentials against multiple SMB shares or WinRM.
• John the Ripper / Hashcat: For cracking any local password hashes or database hashes you dump during the exam.
• Autoroute & Portfwd: The specific Metasploit tools you must master to pivot into hidden subnets.

Understanding the Lab Environment & DMZ

One thing that trips up a lot of people is how the exam network is laid out. You aren’t just hacking a random bundle of machines; you are attacking a corporate network simulation that uses a DMZ (Demilitarized Zone).

Think of a DMZ as a buffer zone between the public internet and a company’s private internal network. The machines sitting in the DMZ are public-facing — like a company’s web server or mail server. Because anyone can access them, they are highly exposed to attacks.

Your eJPT environment starts exactly like this:

1. The Public Facing Network: Your Kali machine is dropped outside or right on the edge. The first targets you scan are sitting in this public zone or DMZ.
2. The Wall: Because the internal corporate network is safely hidden behind a firewall, you cannot scan or touch the private internal machines directly from your Kali instance.
3. The Pivot: To bypass this, you have to compromise one of the public machines in the DMZ first. Once you get a shell on a DMZ machine, you use it as a “bridge” (or a pivot). By running your commands through that compromised machine, you can finally see and attack the hidden internal targets on the other side.

TryHackMe Practice Selection

These are the exact rooms I highly recommend focusing on from my own preparation to build the right muscle memory for the eJPT environment:

Linux Labs

• Kenobi & RootMe (Great for basic enumeration and priv-esc fundamentals)
• Vulnversity (Directory fuzzing and systemd exploitation)
• Simple CTF & LazyAdmin (Common CMS vulnerabilities)
• Tomghost (Protocol exploits like Ghostcat)

Windows & Active Directory

• Blue & Ice (Windows enumeration and Metasploit fundamentals)
• Steel Mountain & Alfred (Web footholds and token impersonation)
• Attacktive Directory (SMB enumeration and basic AD structure)

Metasploit Practice

• Game Zone (Reverse SSH tunneling)
• Dav (WebDAV exploitation)
• DogCat (Log poisoning and directory traversal)