eJPTv2 Experience — 2024

Introduction:

I haven’t been writing here lately as I have been quietly working towards the eJPTv2. I am happy to say that I passed on my first attempt (something I have heard is uncommon) and am looking forward to sharing write-ups on many of the TryHackMe and HackTheBox labs I did while preparing for the test.

I started working on my red team skills around a year and a half ago. Prior to that, I knew how to use some tools but really wanted a practical way to improve my blue team instincts by learning to think like an attacker. Back then, the idea of passing an exam like this didn’t seem feasible, but I have found CTFs to be fun and have moved into a position at work where I spend a lot of time presenting penetration test results and scoping upcoming tests. I have found that learning these skills has been beneficial to my cybersecurity communication skills.

My Background:

Here’s where I might differ. Prior to writing this test, I worked as a system administrator for 10 years and have worked in cybersecurity for the last two. I have a rather extensive blue team skillset, performing OS and network hardening, incident response, SOC team, and forensics. The chances are that most people writing this exam don’t have this background, but I have tried to write this to be beneficial to everyone looking to write the exam.

The Course:

I completed the course before writing the exam. When I did the course, there were two instructors, Alexis Ahmed (HackerSploit), and Josh Mason. The content in the course was thorough, particularly Alexis’ videos. I have seen a lot of people complain about Josh’s videos, but the only complaint I would have is that they are slow-paced. Not everyone is destined to be a video presenter, and not all educational materials have to be entertaining. Honestly, if the other instructor hadn’t been the talented HackerSploit, I doubt that anyone would really notice much difference in the quality.

The course is rated around 150 hours long (I said it was thorough), with much of that being occupied by Alexis’ content. Most people watch the videos at 1.5x or 2x speed, and I did as well. Accompanying these videos are 164 quizzes (normally 1 or two questions) and 121 labs.

Tips to be Successful with the Course:

1. Take notes: The course prepares you well for the exam, and detailed notes will prevent you from having to Google during the exam period. I will go into more detail on this part during the conclusion and exam sections.
2. Do the labs prior to watching the videos: This one seems a bit strange, but I really wanted to test myself on the materials. I treated each lab like a small CTF. I really wanted to become efficient with red teaming and used the labs as a way to practice. After I completed the labs, I watched the videos. This made each video an opportunity to watch “how a pro does it,” and I found lots of small things in their approach that proved to be really useful takeaways. For those with no prior experience, I would recommend this approach when reviewing course materials before the exam.
3. Don’t rush: It’s easy to be overwhelmed by the amount of material in the course, especially if you work full-time or if you have other duties in your life like family. Remember not to rush and to absorb as much knowledge as you can from these two experienced penetration testers. This is your chance to get your money’s worth. The eJPT isn’t HR gold (yet), so chances are that if you are writing this test, you plan to challenge the OSCP later on. Use this as your opportunity to learn!

What I Learned:

Disclosure: Prior to writing this test, I have done CTFs in competitions and on platforms like HackTheBox.

I was already familiar with the majority of the tools used in the course. Some were new, like enum4linux and crackmapexec, but I still appreciated getting a thorough breakdown of what each tool did. As that’s not something you really learn doing CTFs. I would be doubtful that the majority of CTF players could pay attention to every video and state that they “didn’t learn anything,” like I have seen in some other videos, Reddit posts, and Medium articles.

A major thing I learned was methodology. Prior to taking the course, I could do an easy retired machine on HTB without the walkthrough, but it would take me 6+ hours. This is largely because I didn’t have a good methodology for enumerating and testing common services. This course gives you a good understanding of the differences between penetration testing and hacking. Think of all the walkthroughs you have seen where someone finds a foothold on a server because they just happen to know of the weakness. After the course, I was able to complete the majority of the preparation CTFs in around an hour.

Additionally, the exam itself doesn’t mark you on if you root all of the boxes. It marks you based on how you perform in the simulated penetration test. This means that much of the time I spent writing the test, I was enumerating, and if I rooted a box, I now had to enumerate again, but this time with credentials. This is how you get a complete picture of the vulnerabilities in a network, and this is what a customer expects from a penetration test. After all, companies aren’t going to be nice enough to create flag.txt files on sensitive systems to pat you on the back after you get them all. They want reassurance that they are secure.

If you have never done a CTF before or if you don’t have any practical red teaming experience, this course will be a great place to start. But while the course does a great job teaching you all of the tools you will need, additional preparation for the exam is necessary so you can really learn to think like an attacker, and each CTF you do, you will want to ensure that you are following a tight methodology to be as thorough as possible with your enumeration. Creating a scenario similar to one in the exam.

Prepping for the Exam:

I read multiple blog posts and Reddit posts about how others prepared for the exam. Additionally, I found multiple notes made by others that mentioned how they prepared. Here are the labs I did to prepare, and I’ll highlight what skills you can practice. Some of these were repeats for me, and some I did multiple times to practice the skills required for the exam or if I got stuck at some point and had to check a walkthrough to see where I was going wrong.

TryHackMe:

• Basic PenTesting (bruteforcing, hash cracking, service enumeration, Linux enumeration, Linux privilege escalation)
• Pickle Rick (web enumeration and exploitation)
• RootMe (web enumeration, msfvenom, privilege escalation)
• SimpleCTF (enumeration, vulnerability exploitation, privilege escalation)
• Bounty Hacker (bruteforcing, privilege escalation)
• LazyAdmin (enumeration, exploitation, privilege escalation)
• c4ptur3-th3-fl4g (decoding, encoding, hashes)
• Skynet (SMB, web exploitation, privilege escalation)
• Startup (steganography(not required for the exam), bruteforcing, privilege escalation, log analysis, web exploitation, cron)
• Brooklyn Nine-Nine (steganography, privilege escalation, web enumeration)
• Ignite (web exploitation, privilege escalation)
• Wgel CTF (enumeration, SSH persistence, privilege escalation)
• Chill Hack (privilege escalation, web exploitation, evasion, pivoting, SQL injection, steganography)
• ToolsRus (bruteforcing, web exploitation)
• GamingServer (SSH key cracking, web enumeration, privilege escalation)

HackTheBox:

• Pilgrimage (web exploitation, SQL, privilege escalation)
• Knife (web exploitation, privilege escalation)
• Blue (vulnerability analysis, exploitation)

This might seem like a long list, but without more labs provided by INE, I found this to be good practice. Some of these labs do require a subscription. Additionally, if you are new to red teaming, I would recommend the starting point on HackTheBox as a great way to get some additional insight into what you need to do. Many people have also recommended the Jr. Penetration Tester path in TryHackMe.

Exam:

I started the exam on most people’s first day back from holidays. I spent around 12 hours answering questions from the exam and additional time the following day doing more enumeration and testing.

Tips for the Exam:

1. Checklists: Remember when I said to take notes? The days before the exam, I reviewed all of my notes and moved them into Cherry Tree (note-taking app recommended by INE) and broke them down based on the activity I needed them for (following a similar pattern as HackTricks). Additionally, I wrote my notes in such a way to easily copy and paste commands so I could work faster (even though I rarely did this). Making these exams ensured that I was able to follow a clear methodology to simulate a penetration test for the exam.
2. Cherry Tree: This is a great note-taking app. Ensure that you take notes during the exam on your local machine. You will have to reset the lab, and you don’t want to redo hours of work every single time. Copy the commands that allow you to exploit the machine and compromise them again with your notes after resetting.
3. Take Breaks: Part of the reason I spent so long working on this exam is due to not taking breaks. I struggle with test anxiety, and at times I would overthink problems and spend far too long working on a problem and spinning my wheels because I was in a bad headspace. If you are stuck, take a good long break. Get away from screens, lay down, and if possible, socialize. Even though you’re away from your keyboard, you will save a lot of time and frustration. 48 hours is lots of time to complete the materials.
4. Don’t hesitate to contact support: I specifically wrote my exam the day everyone gets back from vacation because I wanted to ensure support would be available. Additionally, if you do have a problem and submit a ticket, they might not reply for 2 days (must be a nice SLA to have). Make sure you reach out to them sooner than later as you probably won’t get answers immediately.
5. Review the provided materials: To simulate a real penetration test, there are rules of engagement and notes on the testing environment. Review them for a while prior to the exam as they contain good information and recommended tools to use during the exam. If you use all of the tools in the provided documentation, you will likely pass.
6. Read the experiences of people that fail: Failing is a great way to learn, and I found that I was able to be more prepared from reading Reddit posts from people who either failed the exam or passed on the second attempt. Reading their experiences and weaknesses they discovered from their failure allowed me to prepare much better and likely get a better score. Had I not read these, I likely would have made similar mistakes or approached the exam like a CTF which it is definitely not.
7. Use only the tools in the course: INE states that answering questions is the only part that contributes to your grade, but it is obvious that they do additional checks with your attack box prior to grading you. For instance, I utilized PowerShell Empire as a C2, and the actions I performed in here were missed from my final score leaving me with only 85%. This means that there was nearly an entire network’s worth of activities that they neglected to grade. Some of the ways the course wants you to do things are definitely not the best, but better ways are easy to teach yourself, particularly where C2s and Pivoting are involved.

As I like doing CTFs, I found this exam to be pretty fun. A couple of times I even got up and celebrated when I popped a shell or escalated my permissions. However, I was hoping for more skills to be included. For instance, if I crack a hash, I would like there to be a payoff later on by using the credentials as a foothold on another machine as reused credentials are a very common real-world vulnerability.

Conclusion:

The eJPT is a great course and exam for those early in your red teaming journey, and I am happy that I enrolled in it. If you work in cybersecurity (blue team) or if you want to get started on your journey to OSCP, this is a great certification to pick up.

The course and exam are relatively inexpensive, making them a great way to use your own money to convince an employer to pay for your OSCP ;) I definitely think that anyone with an interest in red teaming should invest the time and money into acquiring this certification.

For anyone interested in writing the exam yourself, here is a link to my notes, and my Cherry Tree folders containing the checklists I prepared for the exam.

Link: https://github.com/y3t1sec/ejpt_study_notes