eJPT study plan
eJPT · Give each week a clear focus.
8 weeks · About 7 hours per week
Assessment Methodologies
Build an isolated lab (attacker VM, two target VMs, host-only network) and verify connectivity between all three hosts
Write a scoping document defining rules of engagement, in-scope CIDRs, and out-of-scope hosts for a fictional client
Perform passive information gathering on a target domain using WHOIS, DNS lookups, and search-engine recon, logging every finding
Map the four eJPT domains against a self-assessment checklist and record a confidence score (1-5) for each
Your checkpoint
A 3-page engagement document (scope + ROE + passive recon findings table with 15+ entries) plus a completed confidence-score matrix for all four domains
Assessment Methodologies & Host and Network Penetration Testing
Execute host-discovery sweeps across a /24 with Nmap (ARP, ICMP, TCP ping) and record live hosts
Enumerate services and versions on all discovered hosts and identify the OS of at least two of them
Enumerate SMB, FTP, HTTP, and SSH services with at least one dedicated tool per service and capture banner/version data
Search local exploit databases and public CVE references for the versions found and rank findings by exploitability
Your checkpoint
A host and service inventory spreadsheet covering every live lab host, with port, service, version, and a severity ranking for each finding
Host and Network Penetration Testing
Configure and use Metasploit (workspace creation, db_import of Nmap output, module search) against the lab targets
Gain an initial foothold on one Linux and one Windows target and document the exact module/command chain used
Generate and deliver a payload with msfvenom, then upgrade a basic shell to a fully interactive session
Transfer files to and from a compromised host using at least three different methods (Netcat, HTTP server, SMB)
Your checkpoint
A step-by-step exploitation write-up for two lab hosts including commands, timestamps, and screenshots-free textual proof of the sessions obtained
Host and Network Penetration Testing
Enumerate and escalate privileges on the Linux target using at least four techniques (SUID, sudo misconfig, cron, kernel/version check)
Enumerate and escalate privileges on the Windows target using service, registry, and credential-recovery techniques
Perform password attacks against a lab service with Hydra and crack the captured hashes offline with John the Ripper
Pivot from a compromised host to a second internal network segment and reach a host not previously visible
Your checkpoint
A privilege-escalation and pivoting report proving root/SYSTEM on both targets and listing all credentials recovered, including one host reached only through the pivot
Host and Networking Auditing
Run advanced Nmap scans (NULL, FIN, XMAS, idle, fragment, custom timing) and explain the response differences observed
Capture and analyse traffic in Wireshark to identify cleartext protocols and extract credentials from a lab session
Audit a Linux host against a hardening baseline (users, sudoers, services, cron, file permissions) and produce a findings list
Audit a Windows host for missing patches, weak policy settings, and unnecessary services using built-in or free tools
Your checkpoint
A host and network auditing report with at least 12 concrete findings, each with evidence, risk rating, and a one-line remediation action
Web Application Penetration Testing
Enumerate a web application's directories, virtual hosts, and parameters with Gobuster/ffuf and Burp Suite
Identify and exploit SQL injection (manual and sqlmap) to extract data from a lab database and dump a credential table
Identify and exploit reflected and stored XSS, and demonstrate session-cookie theft
Identify and exploit local and remote file inclusion, and upload a web shell through an unrestricted file-upload flaw
Your checkpoint
A web application pentest report on the lab target covering five vulnerability classes, each with request/response evidence and a remediation recommendation
Host and Network Penetration Testing & Web Application Penetration Testing
Complete one full end-to-end lab walkthrough - recon to compromise to web exploitation - without consulting notes
Re-audit the four-domain confidence matrix from week 1 and identify the three weakest skills
Drill the three weakest skills with targeted lab repetitions until each is performed twice cleanly from memory
Rehearse documenting findings in the format expected during a timed practical exam
Your checkpoint
A timed 4-hour unassisted walkthrough log with a completed findings report and an updated confidence matrix showing improvement on every domain
Host and Network Penetration Testing & Assessment Methodologies & Host and Networking Auditing & Web Application Penetration Testing
Take at least two full timed practice assessments under exam conditions, scoring each attempt
Review every missed item and re-run the corresponding lab exercise for each one
Verify the exam-day toolchain: confirm every needed VM snaps cleanly, tools launch, and a fallback note-taking workflow exists
Write a one-page quick-reference of core commands and methodology steps you will mentally replay before starting
Your checkpoint
Two scored practice attempts with a gap-analysis page listing each missed topic, the corrective lab performed, and a dated retest result
Milestones
Week 2: You can enumerate a full /24 and produce a complete host/service inventory without following a walkthrough
Week 4: You hold root and SYSTEM on both lab targets and have pivoted into a second network segment unassisted
Week 5: You can explain the difference in responses between a SYN, NULL, FIN, and XMAS scan and correctly extract credentials from a packet capture
Week 6: You have exploited SQL injection, XSS, file inclusion, and file upload against the lab web app with reproducible evidence
Week 8: Two timed practice assessments are complete, both scored, with every missed item remediated and retested