How to Pass the eJPT

Having recently completed the eLearnSecurity Junior Penetration Tester (eJPT) certification, I decided to write this post detailing the commands and techniques I used to pass. The hope is that this resource can be helpful to other student studying for this certification. For my full thoughts on this certification in the form of a review, check out my other post titled eLearnSecurity Junior Penetration Tester (eJPT) – Course Review.

The caveat here is that not all of these commands will be necessary in the exam, and there may be commands missing that are. These are simply the ones that I personally found useful when studying and taking the exam. Your experience may vary. I’d also highly recommend anyone taking the exam be able to understand exactly what each command is doing, and when you would use them given a certain scenario. Essentially what I am saying here is to not use this as a ‘be all, end all’ when it comes to the eJPT, and to do your own study/research. If you don’t cut corners and study the PTS course content, videos and labs then you will be fine.

To use these commands, make sure to:

Replace ‘’ with the relevant IP address
Replace ‘port’ with the relevant port number
Replace /path/to/x with the relevant path to the relevant file


One thing I am almost sure you will have to do is set up IP routing and routing tables. There are plenty of resources available online for this, but the course content itself seemed to be pretty lacking here. If you read through my accompanying post, you’ll know that I didn’t pay for the videos or labs, so I can’t comment on how well routing is explained in the full version of the PTS, but this is probably the thing that I had the most trouble configuring.

ip route add ROUTETO via ROUTEFROM


Anyone experienced in penetration testing will tell you that enumeration is 90% of the battle, and I don’t disagree. Although the eJPT doesn’t require a very in depth enumeration cycle, it does cover a broad number of techniques.



Ping Sweep

fping -a -g 2>/dev/null
nmap -sn

Nmap Scans

OS Detection

nmap -Pn -O

Nmap Scan (Quick)

nmap -sC -sV

Nmap Scan (Full)

nmap -sC -sV -p-

Nmap Scan (UDP Quick)

nmap -sU -sV

Web Applications

The following commands could be useful when enumerating and attacking web applications. Again, make sure you understand what each one does rather than blindly throwing them at the machine in question.

Banner Grabbing

nc -v port

OpenSSL for HTTPS services

openssl s_client -connect


httprint -P0 -h -s /path/to/signaturefile.txt

HTTP Verbs


Use the OPTIONS verb to see what other verbs are available

nc 80

You can use HTTP verbs to upload a php shell. Find the content length, then use PUT to upload the shell. Make sure you include the size of the payload when using the PUT command.

wc -m shell.php
x shell.php

PUT /shell.php
Content-type: text/html
Content-length: x

Directory and File Scanning

My preferred tool at the moment is dirsearch, I find it to to be fast and easy to use. For a more in depth scan, use gobuster and include a large wordlist. -u -e *
gobuster -u -w /path/to/wordlist.txt

Advanced Google Searches

Not really necessary, but useful to know all the same.

AND, OR, &, |, -

Cross Site Scripting (XSS)

The general steps I use to find and test XSS are as follows:

1. Find a reflection point
2. Test with <i> tag
3. Test with HTML/JavaScript code (alert('XSS'))

Reflected XSS = Payload is carried inside the request the victim sends to the website. Typically the link contains the malicious payload
Persistent XSS = Payload remains in the site that multiple users can fall victim to. Typically embedded via a form or forum post


sqlmap -u -p parameter
sqlmap -u  --data POSTstring -p parameter
sqlmap -u --os-shell
sqlmap -u --dump

System Attacks

The other type of ‘attack’ you will be doing are system attacks. Make sure you understand why/how to brute force types of services and hashes, as well as basic metasploit usage.

Password Attacks


This prepares a file for use with John the Ripper

unshadow passwd shadow > unshadow

Hash Cracking

john -wordlist /path/to/wordlist -users=users.txt hashfile

Network Attacks

Brute Forcing with Hydra

replace ‘ssh’ with any relevant service

hydra -L users.txt -P pass.txt -t 10 ssh -s 22
hydra -L users.txt -P pass.txt telnet://

Windows Shares Using Null sessions

nmblookup -A
smbclient -L // -N (list shares)
smbclient // -N (mount share)
enum4linux -a

ARP spoofing

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i tap0 -t -r


Metasploit is a very useful tool for penetration testers, and I’d recommend going through a Metasploitable for an effective, hands on way to learn about Metasploit. There are plenty of guides and walkthroughs available to learn from. Doing even part of a Metasploitable box will more than prepare you for the Metasploit usage required here.

Basic Metasploit Commands

search x
use x
show options, show advanced options
SET X (e.g. set RHOST, set payload x)


The below are some handy commands for use with a Meterpreter session. Again, I’d recommend going through a Metasploitable or doing some extra study here.

sessions -l
sessions -i 1
sysinfo, ifconfig, route, getuid
getsystem (privesc)
download x /root/
upload x C:\\Windows
use post/windows/gather/hashdump



17 thoughts on “How to Pass the eJPT

  1. Thanks for your advices! I have just passed tday the exam. 90%, I was not able to answer one of the questions, but your resume is a fast way to have some useful commands by hand.

    Liked by 1 person

  2. Hi – I just passed the eJPT. Finding this command for routing “ip route add ROUTETO via ROUTEFROM” on your site here was what allowed me to pass the exam. After using this, everything else was straightforward. Thank you.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s