As a computer admin/engineer working with small businesses I have a moderate level of IT knowledge, mostly in the Windows operating systems, common software and basic networking. Comparing the various computer security certifications, especially the penetration testing ones, I was looking for something that was practical and would suit my level of computer knowledge. I’ve done various Microsoft exams in Servers, Workstation OS’s, networking etc and have been a bit disappointed in how easy to cram they are – I always studied the books and set up labs and actually practiced it but you can pass them with braindumps if you so wish. Since I’m doing pentesting primarily for my own interest, that sort of exam is of no interest. After some searching I hit upon Elearn’s eJPT course https://www.elearnsecurity.com/course/penetration_testing_student/. The course is the Penetration Testing Student (PTS) and the cert, if you pass the exam, is the eJPT.
Learning is via Flash slides (you only get PDFs if you pay for the top tier “elite” plan), videos and their Hera labs which are virtualised lab environments with specific learning goals and objectives. I went for the Full Plan which includes the exam, a retake, 30 hours of lab time and some other bits.
First off the Flash powered slides are a bit annoying. It’s an outdated way of presenting information, won’t run on most phones without some jiggery-pokery and doesn’t travel well. I like to lie in a bath with technical books where my brain seems to soak up info and that’s not possible. However the extra money for the PDFs isn’t worth it in my opinion. That aside, the information delivered is really good. It’s well planned, develops at a sensible pace, is quite precise and covers a reasonable amount of ground for a beginner. I never felt overwhelmed but I did need to concentrate. It also covers some prerequisite info on networking, basic coding etc which is really handy. Actually the networking part is crucial for the exam. Without giving anything away, you’d better understand routing tables better than I did! The main areas covered are:
- Information Gathering
- Footprinting and Scanning
- Vulnerability Assessment
- Web Application Attacks
- System Attacks
- Network Attacks
In that lot you are introduced to nmap, Nessus, dirb/Dirbuster, Wireshark, SQLi, cross-site scripting, SMB vulnerability, null sessions, Metasploit, sqlmap, bruteforcing with Hydra, cracking with John the Ripper and other related tools/concepts.
The videos are excellent in my opinion. They mostly cover the practical application of the the more theoretical slides info. They may cover a specific type of attack or a common tool like BURP Suite.
At the end of each chunk, after the videos for that section, there are Labs. They use their platform called Hera Labs and they are pretty good. You VPN onto your own personal instance of a virtualised lab and complete a task – enabling you to use the skills you’ve learned up to that point to complete the stated target for the lab. There is a PDF for each lab with a walkthrough to check you did it correctly. The labs reset after a while, or you can manually reset them, so making mistakes doesn’t matter. Lab time only ticks over when you’re on them so there’s no real rush. 30 hours was easily enough.
There is a forum to ask questions and the hosts are helpful.
At the end of the course there is an exam where you get presented with a pentesting brief, a new, more complex lab to join and a set of questions to answer that demonstrate you’ve done what is required and gained access to the network, sites, machines, databases and so on. The test is open 24/7 for 3 days but I cannot believe anyone would need that. I wasted about 5 hours realising I hadn’t understood the analysis of wireshark dumps and routing. Once I’d rectified that, the rest is pretty simple. If you complete the course, watch the vids and do the labs, you’re going to pass.
Overall I’d rate it as a very good course for the level I’m at. I learned a lot in a well-planned and structured way. I enjoyed pretty much every minute of it and came away with practical skills and knowledge to build on.
EDIT:
Since writing this review, I’ve embarked on Offensive Security’s OSCP / Pentesting with Kali (PWK) course and this has only served to reinforce how good I think the eJPT is as an entry-level cert. It has really helped me get into the OSCP course much more easily than I would have done and, to be frank, the course material for quite large portions of the OSCP isn’t that different or even taught to that much more depth. I’m not saying they’re on the same level because they’re not. But for much of the basics (nmap, null sessions, netcat etc) it’s very similar. However the eJPT is taught more directly and benefits from the specific lab challenges at the end of each lesson to make sure you understand it. I really wish the PWK course had that.
During the eJPT I put together my own cheat-sheets and methodology sheets and I still find I’m referring to them and they alone were enough for me to crack a couple of the easier PWK lab boxes. So if this is the path you’re thinking of following, you could do a lot worse than starting with the eJPT.
NOTE: I read my firewall logs so I know actual humans are reading these some of these posts – if you are….why not comment and say hi? 🙂
Well since you read your logs I will say Hi.
I am taking the eJPT right now and paid for the ecPPT 5 that just came out so I will jump into that next.
Maybe some day I will go for the OSCP but they really turned me off when one of our coworkers did the OSWP and they told him that he did not capture the keys when the screenshot he sent them in the report even said “You captured the Keys”
When he explained he that he showed it to our CISO and I (the report) since the organization paid for it and I am the senior they told him they were locking him out of further attempts. I understand NDA’s and keeping the tests secret but if he failed to get the keys and only showed it to his management staff that paid for the test; and it was wrong to begin with…why get bent out of shape? Either way I am kind of turned off by Offensive Security over that.
Yeah does seem a bit high-handed.
Anyone taking the OSCP could be showing all details to their co-workers and some will be I’m sure. So singling out a guy who’s only done it to work out where they stand with the people providing the money seems OTT.
Hi Neil,
I did the eJCPT cert like you, before I embarked on the OSCP journey.
I agree 100% with your report on it. The documentation style of PowerPoint slides wasn’t very good. I like to store all my documents on Pentesting in one folder. I open a pdf in FoxIT reader which allows me to search a folder of PDFs for a word or phrase – I find this feature very useful. When searching the PowerPoint style slides it takes a lot longer (seconds but still annoying).
I did enjoy the exam and the lab is fine – not amazing.
Just finished the PTS and will be going for the eJPT cert. The course itself was great but the secret sauce is the Hera Labs. Being able to spin up a full lab on the go is fantastic and a great differentiator from other online courses.
Hi, I’d love a copy of your reference PDFs that you put together. I feel that would be a useful resource for Pen Testing in general.