Mastering the eJPTv2 Exam
Have you ever felt stuck while playing hackthebox or tryhackme? You might know a lot about computer science, but do you know how to hack a machine? CEH is too boring, and OSCP is too hard, but you really want a security certificate even though it won’t actually help you launch a job. Let me tell you the ultimate answer: eJPT.
I highly recommend this exam to someone who wants to learn pentest methodology. Because it really helped me gain confidence in doing pentest.
Exam Overview
eJPT (e-learn security Junior Penetration Tester) used to belong to “e-learn security”. Then “e-learn security” was acquired by “INE” and became “INE Security”. They came up with eJPT version 2 (the current version). It’s very confusing, I know.
The course “Penetration Testing Student” is 148h 53m long. But to be honest, I didn’t finish it. Don’t get me wrong, even though I skipped some lectures, I think the labs are useful.
There are about 121 labs, but no need to do all of them as some of them are duplicated because they want you to review old content.
The exam is 48 hrs with 35 questions, but I think most of the people well prepared can get it done in less than 12 hours. There are 5–6 machines in DMZ and 1–2 machines in the internal network. If you don’t know how to pivot, you’re going to fail. The privilege escalation technique was only used in one Linux machine in my exam.
Exam day experience
Around 11 a.m., I clicked the “Start exam” button. Then, I saw a dashboard with all the questions. I opened the lab page and started initial scanning.
The first few questions were very easy, they asked about IP addresses and system versions which you can find by using the Nmap scan.
Remember that you can skip the question. What I did was go through the questions and focus on the target machines one by one. Soon I hacked my first machine and answered a few questions. Half an hour later, I got another one.
Around 3 p.m., there were about 5 questions left because I couldn’t get privilege escalation on a Linux machine.
I spent many hours trying different scripts and rewatching course videos. I found an executable binary file that could be executed by everyone, so clearly I could use “sudo” and “GTFO bin” to escalate it. But I only had a “www” account which was not in the sudo group. Ran into a rabbit hole. So I went for a dinner.
On the way back home, I realized there was actually only one way left: there must be a credential stored somewhere! So I went back to the browser and googled that web application. Luckily, I found the location where the application stores credentials. And I did find a password there! Turned out that the password belonged to a user who was in the sudo group.
At around 10 p.m., I rooted all the machines. My biggest feeling after submitting was that Metasploit makes everything so easy.
My preparation
For those considering this certification, my preparation journey might offer some guidance.
It would be irresponsible to give advice without introducing my background. To be honest, I’ve been doing this for years, but I wasn’t good at it. I have completed a lot of rooms on Tryhackme, but I still need writeups while doing Hackthebox easy machines. What happened to me most of the time was that I didn’t know what’s the next step while doing pentest. So I took the eJPT course simply because I wanted to learn the methodology.
I finished the course in about 4 months, but I think it should really take less than a month for an individual who has a cybersecurity background. Because the knowledge is really not deep.
One useful thing I did was create a checklist that stores all the commands I would use. It’s extremely useful during the exam. If you don’t want to do it by yourself, you can find a bunch of these on GitHub;)
The next thing I wish I knew was to do the lab first. The exam environment is similar to the lab. If you can complete the lab easily, there’s really no need to watch the lecture. Two sections you should pay more attention to are “Exploitation” and “Post-Exploitation”.
The last thing I did was read others’ reviews on the exam. This will help you better understand the exam because it offers varied perspectives. My case might not be suitable for you.
How to know when you’re prepared
After finishing the PTS course, you might start wondering “How do I know when I’m prepared”. Here are my thoughts.
Understanding everything written in the “final Letter of Engagement” is crucial.
Do Tryhackme ctf rooms as much as possible (below are free rooms):
If you can finish these rooms without the help of writeups, you are good to go.
Tricks
Here are some of my own tricks.
- Remember your checklist, enter those unnecessary commands because they count.
- Use the exclusion method for Multi-choice questions. You know there’s only one right answer, so the other three must be wrong.
- If they don’t want you to use brute force, you’ll know.
- If you’re stuck, try those tools in the lab that you haven’t used.
- If you’re really stuck, refer to similar box writeups on Google or YouTube for guidance.
Conclusion
Always remember: you’re trying to learn to hack rather than collecting a certificate. A real hacker doesn’t need a cert to prove they can hack.
Lastly, have fun hacking, and may the odds be ever in your favor!
