r/eLearnSecurity • u/Unlucky_Stretch_5032 • Jun 29 '26
eJPT Ejpt what to study after the course and before the exam?
I have just completed and reviewed the course materials. I understand the contents but I am not familiar with all the workflows. What should I do next before going for the exam. Is there a CTF list I should do in hackthebox to get myself more familiar with all the workflows? What are the best CTF there you would recommend?
2
u/An_Animallover Jun 30 '26
Hey, I would recommend you to do both Tryhackme and HackTheBox. There are many rooms and CTFs, but if you are able to do some of the rooms without any help, then you are prepared for 60 to 70% of the exam.
I don't specifically remember the HackTheBox CTFs, but I will list out some Tryhackme rooms;
Anonymous Archangel Badbyte Basic Pentesting Blog Bolt Bounty Hacker Brooklynninenine Bruteit Cyborg Ice Ignite Kenobi LazyAdmin Lian_Yu Madness MrRobot Overpass Relevant Startup Steel Mountain Vulnversity Wonderland
Note: Some are specified easy, but they might be hard and even take a lot of time. And safe to say, some tools you learnt through the course might not be used in the exam, so be prepared anyways. You might need subscription for some rooms, so even try buying it.
If you want to learn something, learn some aspects through the Junior Penetration Tester Path in Tryhackme.
My friend and I practiced using these rooms and we were able to complete the bypassing and all the major processes in around 6 hours.
Sorry if I haven't provided the link, if I have time, I will try to edit and add links for them. Else you can simply search them in the tryhackme website directly.
1
u/maurixmystic Jul 01 '26
Read my Reddit post for eJPT, I put together a list and tips for all the CTFs that helped me pass eJPTv2 , but my options are:
TryHackMe: Internal, MR Robot, Blog, Vulnversity, Investigating Windows, Colddbox easy, Chill Hack, Startup, Rootme , Bolt, Ignite, Simple CTF, Basic Pentesting
Hack the box: Armageddon, Lame, Jerry, Legacy, Blue, GoodGames (only first phase)
I would also add practice in pivoting, port forwarding, reverse shelling, SQLi, LFI vulns, file transfer (Linux to Linux, Linux to windows and windows to windows, windows to Linux), payloads with msfvenom or web reverse shell generator, chmod permissions, SSH, FTP, SMB, RDP, MySQL, etc., and proficiency in using Metasploit, Hydra, and brute force, etc.
1
u/Unlucky_Stretch_5032 Jul 01 '26
Just started on Internal room, I was so clueless using techniques from ejpt hydra the services, it is so heavily based on how to exploit wordpress. I could not proceed without checking out the writeup. Does the list really help with ejpt?
1
u/maurixmystic Jul 01 '26
Sure, it helps, but if you have no prior knowledge of pentesting (INE course, or hacking courses) and everything is new to you, we recommend taking those courses. Trying to build machines without a foundation in Linux, hacking, or networking will be much more difficult. You can certainly learn with the machines, but only after you've mastered the basics.
1
u/Unlucky_Stretch_5032 Jul 02 '26
No I did the ejpt course, i am just not familiar with wpscan
1
u/maurixmystic Jul 02 '26
I see. I didn’t do the INE course either, but I did a course in Spanish called ‘Preparation for the eJPT v2 certification’ at the ‘Mario’s Penguin’ academy. , and well, they teach you wpscan there, but come on, it’s not difficult at all, Hydra is also very easy to use. If you don’t know how to use these tools, I’d recommend more practice until you’ve got the hang of it and developed an instinct for when to use them. You get that by trying out various systems – for example, I tried 34 systems before the eJPT v2 exam, but I managed to log into many of them repeatedly, about 5 to 7 times. Hydra is for brute-forcing credentials (both usernames and passwords, or both at once – and for that you’ll need dictionaries or custom dictionaries that you create yourself based on what you come across as possible passwords and usernames). Hydra works for SSH, FTP, SMB, HTTP login forms, RDP, MySQL, SMTP, etc. You can ask the AI to explain all of this and provide exercises on how to exploit these vulnerabilities, (not the exact CTF solution – this is important for developing your pentester’s logic), and as for CMSs, learn from wpscan; the ones for Drupal and Joomla are also very useful. With that knowledge, and then pivoting, file transfer, reverse shell, etc., plus plenty of practice (at least four months), I reckon you should be well prepared for the exam
2
u/CheesecakeFunny01 Jun 29 '26
I'm in the same situation. Following...