eJPT - eLearnSecurity Junior Penetration Tester
The PTS course is very user friendly and is perfect fit for beginners who don't have any experience, or very little prior experience in penetration testing, and require some hand holding with the structure of a curriculum to follow. It is recommended to at least have some basic experience using a Linux Distribution before beginning this course. Which free training can be found from itsfoss just choose one of the top 3 options as the other options are not require for learning Linux. If you enjoy playing games, then you can also check out Linux Survival a terminal based game that is geared towards learning how to use the Linux Terminal.
I can confidently say that if you have spent more than 3 - 6 months of self-study in penetration testing and feel confident with the material that this course covers, then this course is probably not for you. If that's the case, then look into their Penetration Testing Professional PTP course which is the next course after this one and on a similar level as the Offensive Security Certified Professional OSCP although the PTP is not as popular as the OSCP, which holds good value with HR, has good skills to learn, and is cheaper if no discounts are being offered by eLearnSecurity during that time, but with the PTP you can learn more real-world techniques and usage, to include, what to expect from a legal standpoint. On the other hand, if you have the money to spare and would like to get your first or second certification in Cybersecurity, specifically for the Red Team, then the PTS would be a good fit for you. Also, eLearnSecurity does offer a payment plan and if you happen to purchase using a coupon code it does apply to all payments that are made - as I did test this feature out when I purchased their PTP course.
The great thing about eLearnSecurity is that they often do course updates to their material to stay current with the new attack and defense vectors of the Cybersecurity realm, which is based off of real-world solutions and threats and not Capture the Flag (CTF) like structure or materials. So, when you get one of their courses, you can expect quality, but the only downfall for right now is that they are not as popular for HR looking for their certifications because of how slow the job market is to react. However, they are slowly being recognized as a valid certification authority for Cybersecurity training, which is awesome. I have found quite a few jobs online that recognize the quality of their certifications and accept certifications from them. So I know that this will improve in due time, but for now enjoy the fact that you are able to get up-to-date quality training. Also, be on the lookout for discount codes from eLearnSecurity as they often do promotional discounts on their course offerings especially during holidays, course revisions, and new course launches. Just go over to their home page and check it out as they generally advertise their discounts there.
What can you expect to learn from this course:
Section 1: Preliminary Skills and Prerequisites
The Introduction Module covers using VPNs, various levels of Cryptography, and the basic understanding of binary arithmetic.
The Networking Module goes over how to read IPv4 and IPv6 addresses, how to subnet with the two internet protocol types, what are the TCP/IP and the OSI Models, and how networks are connected. How to setup and use Wireshark, configure static routes and spoofing MAC Addresses.
The Web Applications Module walks you through what a domain address is, what a DNS is for, what a three-way-handshake is, and the basics of how applications work. Then continues on by covering how to manipulate cookies, sessions, and various methods that websites use while communicating between your browser and the web server, then you will learn how to setup and use Burpsuite's features, configure the various settings available, editing user/server data, data manipulation, and attack vectors.
The Penetration Testing Module explains what is an Ethical Hacker and covers the terms of White, Grey, Black Hats and Script kiddies and most importantly how to create and follow your own methodology when approaching a target.
Section 2: Preliminary Skills and Programming
The Introduction Module will cover the basic concepts of programming languages and the similar syntax that is used. It will also explain the functionally and levels of using various programming languages.
The C++ Module introduces you to the basics and walks you through how to read and write basic commands in the language. It then proceeds to give you example programs that you can play around with and finally how to properly compile your code using GCC to make a Window's executable program.
The Python Module the provides a great layout to get started with reading and coding the basics, the course will also walk you through on how to build your own program from scratch; while explaining what each part of the program is used for.
The Command Line Scripting Module will give you the bare necessities of scripting in Linux’s Bash and Window’s Command Prompt.
Section 3: Penetration Testing
The Information Gathering Module covers how to effectively gather information on your target without them even knowing that you’re casing them, how to use Passive Reconnaissance techniques; such as, Sub-domain Enumeration, Google Dorking and leveraging the information of a target via social media.
The Footprinting & Scanning Module is all about enumerating your target with Active Scanning and Footprinting of their network to find devices with open ports, software versions, and OS information by using tools such as Net Discover, FPing, Nmap, and Mass scan.
The Vulnerability Assessment Module goes over how to install, setup, and use vulnerability scanners, such as, Nessus and Nexpose to generate vulnerability reports.
The Web Attack Module, further dove into using directory busting tools, like, Netcat, Dirbuster, Dirb, and Sqlmap. In addition, this section covers how to perform Cross site scripting (XSS), and SQL Injection (SQLi) attacks.
The System Attacks Module teaches you how to setup and conduct various password attacks using popular tools such as John the Ripper and Hashcat to perform Brute Forcing, Dictionary Attacks, and covers briefly over how Rainbow Tables work. Then finally goes over how to install backdoors on systems by maintaining persistence using Metasploit.
The Network Attacks Module proceeds with teaching how to use Hydra to launch Dictionary attacks on various services, ARP Spoofing, setting up and using Metasploit to scan, probe, password attacks, and gain access to systems. The module continues by teaching you how to use Meterpreter to move laterally, extract system information, various techniques to gain an initial shell, other tools to use for privilege escalation, and how to improve a non-interactive shell.
The final Next Steps Module, includes a summary of what was taught, what should be your continued path forward and how to maintain the momentum. At this point, you will be either ready to take your exam or go for some hands-on black box penetration testing with 3 separate labs to tackle with lateral network movement that is required to navigate through the labs.
Dashboard User Interface (UI) Tour
Main Navigation Bar
The UI is very pleasant to work with, as it is not overly complicated to navigate around. Located on the left side panel you have your main navigation bar that allows you to navigate to your other Courses page if you are enrolled in multiple courses. Next, you can view their recommended NIST Training Paths. Then, go visit their Exams page and read over the Exam Guide provided to ensure you will be ready for your big exam day; after you have passed your exam head on over to My Certifications page to view and download your first eLearnSecurity certification. Finally, there is the Forum page, which will help you look up any issues and resolutions, or ask any questions that you may have about the course.
Account/VPN Settings Drop Down
Located at the top right corner viewed as your registered email address, is a drop-down menu that will allow you to go manage your account settings and setup your VPN username/password for your initial use. Make sure that you do this step, as it is required to use when working with Hera Labs.
Welcome Course Status and Navigation Pane
In this section you have your Modules and Labs completion meters, that fill up as you mark the labs and modules completed. Which is a great way to track your own progress, also this will update if you feel like you need to go over a module again, you can uncheck the completed module or lab so that you can resume your progress later. To the right side you have your course's Syllabus that you can download as a PDF, Ask Support if you require technical assistance, another way to navigate to your Virtual Labs, and the Certification which will take you to start your exam. Please do notice that the Certification link will be greyed out until you have completed all of your modules.
Course Content
Located as the main body of the page. You can click on the Module names to enter into an HTML viewer to view the content of the slides. Depending on the version you have, you will also have the option to download a PDF of the course content for offline viewing. If you look directly under the Welcome -Your Name- you will see: Resume where you left off -Module Name-. You can click on the module’s name to resume your last working module, which loads the website reading material for that specified module. To the right of that, there is the Resources drop-down, which contains additional materials; such as, videos, other reading materials, and practice examples. The next section is the Labs drop-down, here it will show you what labs are assigned to the module that need to be completed. Once you have completed the entire module, then you can click on the box to mark the module as completed. This will also update the current progress at the top of the page under modules completed by filling up the meter as you complete your modules. You will also be able to view the labs that you have completed located directly beside it in the same fashion as well.
Hera LABS
The Hera labs are great, you get labs that are dedicated to you only and don’t have to worry about sharing the environment with anyone else. In that sense you are responsible for managing your own lab time and must manually start, stop, and reset the lab as needed. If you fail to stop your lab when you have completed it, then your time will continue to deduct from your allotted remaining lab hours, until you click on the stop button.
As far as any lab issues, I’d only ended up having an issue with one of their labs, which they looked into and fixed it. Whenever you have a problem, just go to their Forum page mentioned earlier and find the name of your course then click on it and search for the lab name, make sure you are still logged in and that your session hasn’t timed out or you will be able to access the selected forum. Next, try searching for what your problem is, as there will most likely be a solution to the issue that you are facing. Otherwise, just create new post or submit a post to a preexisting post and generally the course instructor will get back with you within 24hrs or less of submitting your post.
If that is too long of a wait for you, then you can always continue with your course and come back to that lab later after you have received your response. Sometimes, it ends up being your local configuration of your VM or an update to your Kali that became broken, as this had happened to me a couple of times. The good thing is that you will learn how to troubleshoot your problems using the most powerful tool for all professionals in IT and Cybersecurity…
If using a VM such as Oracle’s Virtual Box or VMWare, I highly suggest making frequent back ups of your VM. For Virtual Box just use the Snap Shot feature, but for VMWare Player free edition and not the Pro version, you will have to do a manual backup by copying the entire folder to another location and labeling the folder properly, I suggest naming the folder with a date and adding a note to identify it, or just add a simple text file to the containing folder with notes about the backup.
Another tip is to make sure that while using Hera labs you will need to configure your network on your VM connection to use Bridged mode, as I had mine configured through NAT at the beginning and started getting errors and I was unable to use Nmap for scanning during the labs.
Final Exam & Certification Experience
First of all, don't worry about exam day because you are allowed to use all of your notes, and tools that were taught to you during your certification exam. The eJPT exam is all hands-on and not a CTF style exam, nor is it restrictive. The eLearnSecurity Team is very generous with the time that you have been allotted to complete the exam. To ensure that you are not fully stressed out they give you a full 72 hours to complete your exam; so that you may take your time to ensure that you have everything answered as best as you can based off of your findings.
Luckily with this being a Junior Penetration exam, they do not require you to submit any report, but that doesn’t mean that you should skip out on the details of making a report either. By making a report for yourself you will be able to go back and review what you did and use it for later review, whenever you become more inclined to writing professional reports. Which will become beneficial to you later on to help you analyze your growth. There are some random questions that you will need to be able to answer as your penetration test progresses deeper into your exam via utilizing all of the skills that you gained from following along in the course.
Upon submitting your exam, you will be immediately notified of your score, which is very nice to get that instant feedback of your results. If you happen to get any of your questions wrong it will tell you how many you got wrong, how many you got correct, and how many where partially credited. But that is as far as it goes, as there are no additional details as to which questions were wrong or correct. You are required to get a minimum of 15/20 points on your exam in order to pass and obtain the eJPT certification.
Food For Thought
Overall, the course consists of 15 total modules packed with information, 29 video tutorials, and 19 hands-on labs including the 3 black box lab environments to get plenty of training with. I had gotten the Elite package, so my total lab hours came to 60 hours available with a non-expiration time on the exam voucher plus retakes – so that I could take my time with the course. If you opt for the Full package then you will get the course material, plus 30 hours of lab time, and an exam voucher with a 3-month time limit to take the exam.
My remaining lab time after the course is 27 hours, so I probably could have been ok getting the Full version of the course as the lab hours are only valid for that course and are non-transferable, but was more concerned with the 3-month time clock on the exam voucher – especially since I was still working with Hack the Box learning techniques and various tool usage that were still new to me during my course study.
I really enjoyed the Hera Labs that were provided, as I haven't had any other lab experience like it so far, where you need to move laterally and attack on a pivot through a network in order to advance. Since then, I’ve been through several other labs – which I will also be posting reviews on – that don’t offer a chance to move laterally and pivot to further gain access deeper within the network. I do believe that this is a great feature and learning experience, especially for beginners to be exposed to.
It did take me longer to complete the course than I wanted, because I made the biggest mistake by not taking good notes while going through the course the first time, so I had to go back through the entire course again just to take proper notes – lesson learned; please don’t repeat my mistakes. I did use what I learned from the course as I went through it to tackle a few boxes on Hack the Box so that I could test out my newly learned skills to pop a few boxes; which was encouraging and reassuring about the material that I had covered so far.
I would only recommend this course at a complete beginner’s level with no prior experience as there is quite a bit of hand holding to properly guide you through the Pentesting methodology and how to think like a hacker. I believe that this course brings value to understanding what it takes to become a Penetration Tester, but it only scratches the surface and shows you some of the pathways to choose from.
Upon completion of the course and obtaining my eJPT certification. I felt empowered with knowledge that created a good foundation for me to build off from; which left me wanting to learn more to feed my newfound passion for Cybersecurity. Where did I go next you may ask… Stay tuned, as my journey continues, I will take you down the path of web penetration testing with PentesterLabs…
By the way if you sign up for the Ethical Hacking Network you can get eLearnSecurity's Penetration Testing Student barebones kit for free, which is sponsored by them.
Comments