eJPT – a quick review

As a computer admin/engineer working with small businesses I have a moderate level of IT knowledge, mostly in the Windows operating systems, common software and basic networking.  Comparing the various computer security certifications, especially the penetration testing ones, I was looking for something that was practical and would suit my level of computer knowledge. I’ve done various Microsoft exams in Servers, Workstation OS’s, networking etc and have been a bit disappointed in how easy to cram they are – I always studied the books and set up labs and actually practiced it but you can pass them with braindumps if you so wish. Since I’m doing pentesting primarily for my own interest, that sort of exam is of no interest. After some searching I hit upon Elearn’s eJPT course https://www.elearnsecurity.com/course/penetration_testing_student/. The course is the Penetration Testing Student (PTS) and the cert, if you pass the exam, is the eJPT.

Learning is via Flash slides (you only get PDFs if you pay for the top tier “elite” plan), videos and their Hera labs which are virtualised lab environments with specific learning goals and objectives. I went for the Full Plan which includes the exam, a retake, 30 hours of lab time and some other bits.

First off the Flash powered slides are a bit annoying. It’s an outdated way of presenting information, won’t run on most phones without some jiggery-pokery and doesn’t travel well. I like to lie in a bath with technical books where my brain seems to soak up info and that’s not possible. However the extra money for the PDFs isn’t worth it in my opinion. That aside, the information delivered is really good. It’s well planned, develops at a sensible pace, is quite precise and covers a reasonable amount of ground for a beginner. I never felt overwhelmed but I did need to concentrate. It also covers some prerequisite info on networking, basic coding etc which is really handy. Actually the networking part is crucial for the exam. Without giving anything away, you’d better understand routing tables better than I did! The main areas covered are:

• Information Gathering
• Footprinting and Scanning
• Vulnerability Assessment
• Web Application Attacks
• System Attacks
• Network Attacks

In that lot you are introduced to nmap, Nessus, dirb/Dirbuster, Wireshark, SQLi, cross-site scripting, SMB vulnerability, null sessions, Metasploit, sqlmap, bruteforcing with Hydra, cracking with John the Ripper and other related tools/concepts.

The videos are excellent in my opinion. They mostly cover the practical application of the the more theoretical slides info. They may cover a specific type of attack or a common tool like BURP Suite.

At the end of each chunk, after the videos for that section, there are Labs. They use their platform called Hera Labs and they are pretty good. You VPN onto your own personal instance of a virtualised lab and complete a task – enabling you to use the skills you’ve learned up to that point to complete the stated target for the lab. There is a PDF for each lab with a walkthrough to check you did it correctly. The labs reset after a while, or you can manually reset them, so making mistakes doesn’t matter. Lab time only ticks over when you’re on them so there’s no real rush. 30 hours was easily enough.

There is a forum to ask questions and the hosts are helpful.

At the end of the course there is an exam where you get presented with a pentesting brief, a new, more complex lab to join and a set of questions to answer that demonstrate you’ve done what is required and gained access to the network, sites, machines, databases and so on. The test is open 24/7 for 3 days but I cannot believe anyone would need that. I wasted about 5 hours realising I hadn’t understood the analysis of wireshark dumps and routing. Once I’d rectified that, the rest is pretty simple. If you complete the course, watch the vids and do the labs, you’re going to pass.

Overall I’d rate it as a very good course for the level I’m at. I learned a lot in a well-planned and structured way. I enjoyed pretty much every minute of it and came away with practical skills and knowledge to build on.

EDIT:

Since writing this review, I’ve embarked on Offensive Security’s OSCP / Pentesting with Kali (PWK) course and this has only served to reinforce how good I think the eJPT is as an entry-level cert. It has really helped me get into the OSCP course much more easily than I would have done and, to be frank, the course material for quite large portions of the OSCP isn’t that different or even taught to that much more depth. I’m not saying they’re on the same level because they’re not. But for much of the basics (nmap, null sessions, netcat etc) it’s very similar. However the eJPT is taught more directly and benefits from the specific lab challenges at the end of each lesson to make sure you understand it. I really wish the PWK course had that.

During the eJPT I put together my own cheat-sheets and methodology sheets and I still find I’m referring to them and they alone were enough for me to crack a couple of the easier PWK lab boxes. So if this is the path you’re thinking of following, you could do a lot worse than starting with the eJPT.

NOTE: I read my firewall logs so I know actual humans are reading these some of these posts – if you are….why not comment and say hi? 🙂