eJPT exam playbook

Record every host, port, service, version, hostname, credential and route. Start broad, then run focused scans against discovered services. Check all TCP ports when the first scan does not explain the lab: preparation CTFs often place FTP or web services on non-standard ports.

For each open port, answer four questions: what is it, which version/configuration is exposed, what can be accessed anonymously, and what new usernames, files or hosts does it reveal? Reuse discoveries across services. A username from SMTP, a password from a backup and a hidden SMB share may form one path.

Inspect headers, source, robots.txt, common backup files, exposed .git data, virtual hosts, directories and supported methods. If authentication is present, identify its type before testing credentials. Treat uploads and writable shares as execution paths only after proving where files are served.

Try anonymous and null-session access before password testing. Keep credential attacks small and targeted: start with usernames and wordlists supplied or discovered in the lab, watch for lockouts, and stop when evidence disproves the path.

A shell changes the visible attack surface. Identify the user, interfaces, routes, listening services, credentials and writable paths. Internal-only services and a second subnet are signals to pivot. Add the route first, verify reachability, then scan through the pivot with techniques compatible with the tunnel.

Keep notes as you work, save scans, answer from direct evidence and revisit unresolved services when progress stalls. The useful cycle is enumerate, form a hypothesis, run the smallest validating test, record the result and enumerate again. Do not let one exploit attempt replace methodology.