Click any topic to see why it matters — several also expand with the actual commands, syntax, or workflow you'd use. Companion to eJPT Study Reference (the interactive tracker) — that one is for fast lookup mid-exam, this one is for actually learning the material beforehand.
The OSI model isn't trivia here — every enumeration and exploitation technique later in the course is really "operating at layer X." Knowing which layer a technique lives at is what lets you reason about why a firewall blocks one thing and not another.
| Layer | What lives here | Why it matters for eJPT |
|---|---|---|
| 7 — Application | HTTP, DNS, SMB, FTP, SSH | Almost everything you'll enumerate/exploit operates here — this is where your time goes |
| 4 — Transport | TCP/UDP, ports | Port scanning lives here — understanding the TCP handshake explains why -sS vs -sT behave differently |
| 3 — Network | IP, routing | Pivoting and subnetting — knowing how routing actually works is what makes proxychains/chisel make sense instead of feeling like magic |
| 2 — Data Link | MAC addresses, ARP | ARP-based host discovery (nmap -PR) and ARP spoofing/relay attacks operate here |
This is the actual certification curriculum — everything under Sections 2–5 is core. Deep dives below concentrate on the highest-yield material; lighter items still matter, just less likely to anchor a whole question chain on their own.
The point of passive recon is learning everything you can without touching the target — no packets sent, nothing logged on their side. On the exam this is where you build your initial target/subdomain/email list before Nmap ever runs.
| Technique | Tool | What it gives you |
|---|---|---|
| Website recon & footprinting | Browser, view-source, robots.txt | Tech stack hints, hidden paths, comments left in source |
| Whois enumeration | whois domain.com | Registrant info, name servers, registration dates |
| Website footprinting | Netcraft | Historical hosting/tech data without ever hitting the target directly |
| DNS recon | dig, nslookup, host | A/MX/TXT/NS records — mail servers, subdomains hinted at in records |
| WAF fingerprinting | wafw00f target.com | Tells you if a WAF is in play before you start throwing payloads that'll just get blocked |
| Subdomain enumeration | sublist3r -d target.com | Expands one domain into many hosts — often where the actually vulnerable app is hiding |
| Google dorking | site:target.com filetype:pdf, intitle:"index of" | Indexed files, exposed directories, login portals search engines already crawled for you |
| Email harvesting | theHarvester -d target.com -b all | Employee emails/usernames — direct input to a later password-spray or phishing step |
| Leaked password databases | Have I Been Pwned-style lookups | Known-breached credentials tied to harvested emails — a free password-spray candidate list |
Active recon touches the target — it's noisier but far higher-yield. The two techniques here recur constantly: a misconfigured DNS zone transfer can leak your entire internal host list in one command, and Nmap host discovery is how you build the target list every later phase works from.
# DNS zone transfer — misconfigured servers will just hand you every record dig axfr @ns1.target.com target.com # Host discovery across a range before you scan anything in detail nmap -sn 10.0.0.0/24
Why zone transfer specifically: it's rare that it works, but when it does it's the single biggest information leak available — an entire internal DNS namespace in one query, for free.
This module re-teaches the OSI/TCP layers specifically in the context of scanning — worth the repetition, because it's what explains why ping sweeps, ARP discovery, and TCP-based discovery each catch different hosts (a firewalled host might drop ICMP but still answer a TCP SYN on an open port).
| Discovery method | Command | When it works when ICMP is blocked |
|---|---|---|
| Ping sweep | nmap -sn 10.0.0.0/24 | No — pure ICMP, first to get blocked |
| ARP scan (local subnet only) | nmap -sn -PR 10.0.0.0/24 | Yes — ARP can't be firewalled on the same L2 segment |
| TCP SYN discovery | nmap -sn -PS22,80,443 10.0.0.0/24 | Yes, if any of those ports is open and reachable |
This is the module the whole exam's first few hours run on. The habit that matters more than any individual flag: scan fast and wide first, then slow and deep on what you found — never the reverse.
nmap -p- --min-rate 5000 -T4 10.0.0.5 # find every open port fast nmap -sC -sV -p <found-ports> -oN scan.txt 10.0.0.5 # then detail-scan just those nmap -f -T2 10.0.0.5 # fragment packets + slow timing, when IDS evasion matters
Always save output (-oN/-oX/-oG) — you will need to grep back through a scan from six hours ago, and re-running it against a live exam network wastes time you don't have.
This module is the direct source of the service-by-service enumeration commands in your Study Reference's Quick Reference — study it there in depth; the one thing worth internalizing conceptually here is the order of operations: enumerate everything before exploiting anything. A box with six open ports and one obvious web vuln often has the actual intended path sitting quietly on FTP or SMB instead.
Also covered here: importing an Nmap scan directly into Metasploit's database (db_import scan.xml) so every later module in MSF can reference the hosts/ports you already found — saves re-typing target info into every module's RHOSTS.
This is where recon turns into a target list of known, named vulnerabilities — EternalBlue (MS17-010), BlueKeep (CVE-2019-0708), WebDAV misconfig, Shellshock (CVE-2014-6271), pass-the-hash — each of these gets its own dedicated hands-on module later in Section 4, so this is the conceptual map before the exploitation happens.
| Vulnerability | Affected | Why it's high-yield to know cold |
|---|---|---|
| MS17-010 (EternalBlue) | SMBv1, unpatched Windows | Reliable, well-known, and one of the most commonly reused targets in training environments |
| CVE-2019-0708 (BlueKeep) | RDP, unpatched Windows | Pre-auth RCE over a service that's almost always exposed on a Windows box |
| CVE-2014-6271 (Shellshock) | Bash via CGI | Classic web-to-shell pivot, still shows up in training labs constantly |
| Pass-the-hash | SMB/RDP/WinRM with a captured NTLM hash | Doesn't need the plaintext password — direct payoff of any hash you dump later |
Tools: nmap --script vuln, Metasploit's auxiliary/scanner/* modules, Nessus for a broader automated sweep, WMAP for web-app-specific scanning inside MSF.
Conceptual and compliance-flavored rather than hands-on — the one practical tool worth knowing is Lynis (lynis audit system), a Linux security-auditing scanner that gives you a hardening score and specific findings. The GRC/standards material (frameworks, policy lifecycle) is background you should recognize by name rather than a hands-on skill.
The largest and highest-weighted section — INE's own domain breakdown puts Host & Network Penetration Testing at 35% of the exam, more than any other domain.
The full Windows exploitation-to-privesc chain lives here. Work it as a sequence: get a foothold → check what you landed as → escalate → dump credentials → move on.
| Step | Technique | Why it's in this order |
|---|---|---|
| 1. Initial access | WebDAV upload+exec, PsExec with found creds, EternalBlue, RDP/BlueKeep, WinRM with found creds | Each targets a different exposed service — try whichever is actually open on your target |
| 2. Orient | getuid, sysinfo (meterpreter) or whoami /priv | Confirms your actual privilege level before assuming you need to escalate |
| 3. Escalate | Kernel exploits, UAC bypass (UACMe), token impersonation | Kernel exploits are noisy/version-specific — try UAC bypass and impersonation first, they're more reliable |
| 4. Harvest | Dumping hashes with Mimikatz, Alternate Data Streams for hidden files | SAM hashes feed directly into pass-the-hash against other hosts on the same exam network |
| 5. Reuse | Pass-the-hash | Closes the loop — the hash from Host A gets you into Host B without ever cracking it |
Same shape as the Windows chain, mapped to Linux equivalents: Shellshock/FTP/SSH/Samba for initial access, then kernel exploits / misconfigured cron / SUID binaries for privesc, then dumping /etc/shadow and cracking offline.
Why cron and SUID specifically get their own lessons: they're the two most common real-world Linux privesc vectors, far more often than a kernel 0-day — a cron job running as root against a world-writable script, or a non-standard SUID binary you can abuse via GTFOBins, are both essentially free root if present.
The network-level (as opposed to single-host) attack surface — this is where a weak SMB signing config or a default SNMP community string turns into cross-host compromise instead of just one box.
SMB relay in one sentence: instead of cracking a captured NetNTLM hash, you relay the authentication attempt live to a different host that accepts it — works when SMB signing isn't enforced, and it's a direct escalation from "I captured a hash" to "I have a shell," no cracking required.
This is the single richest module in the whole curriculum — architecture, workspaces, Nmap import, every enumeration/vuln-scan auxiliary module, msfvenom payload generation/encoding/PE injection, resource-script automation, the full Windows and Linux exploitation walkthroughs, meterpreter fundamentals and shell upgrading, the complete Windows and Linux post-exploitation modules (persistence, RDP enabling, keylogging, log clearing, pivoting, hashdump), and Armitage as the GUI alternative.
The core mental model worth internalizing: module → set required options → check payload compatibility → run, repeated for auxiliary (scan), exploit (gain access), and post (post-exploitation) modules alike — once that pattern clicks, every module in MSF works the same way regardless of what it does. Full command syntax is in your Study Reference's Metasploit card; this module is where you'd actually practice it against every service type until it's automatic.
The manual-exploitation skillset for when Metasploit doesn't have a module for what you found. searchsploit is your first stop; "fixing exploits" means adapting a public PoC's hardcoded offsets/paths to your actual target, and cross-compiling covers building a Windows-target exploit from a Linux attack box.
Bind vs. reverse shells and the full one-liner cheat sheet are covered in depth in your Study Reference — this course module is where the underlying "why reverse over bind" reasoning (firewall/NAT direction) is actually taught, not just the syntax.
Everything you do after the first shell — this module is dense and maps almost one-to-one onto your Study Reference's Linux/Windows Privesc, Pivoting, and Post-Exploitation cards. The one habit worth calling out specifically: automate local enumeration (WinPEAS/LinPEAS-style) only after you've done the manual checklist once by hand — otherwise you won't recognize which highlighted finding in a wall of tool output is actually the one that matters.
"Clearing your tracks" (Windows event log clearing, Linux .bash_history/log editing) is taught here specifically as an anti-forensics technique — useful to understand from the blue-team side too, since it's exactly what BTL1's Event ID 1102/104 log-clearing detection is built to catch.
Prerequisite vocabulary for everything else in web testing — request/response structure, common architecture patterns (client/server/DB tiers), and the threat categories you'll be triaging against. Worth actually reading the HTTP request/response modules closely: knowing exactly what a header does is what lets you spot when one's been tampered with or is missing something it shouldn't be.
The reconnaissance-to-exploitation pipeline for a web target, in the order you'd actually run it:
nikto -h target — broad automated misconfig/vuln sweepgobuster dir -u target -w wordlist — find what the crawl missed (unlinked admin panels, backup files)Full SQLi/LFI/upload-bypass technique details are in your Study Reference's Web App Testing card — this course section is where the discovery phase that leads into those techniques is taught.
A newer addition to the curriculum — conceptual rather than hands-on-exploitation. Worth knowing at a working level: what a model/token/prompt/inference actually are, what AI tools are relevant to security work, and — importantly for exam integrity purposes — where the line is on using AI tools during the actual practical exam versus during study. This is exactly the same line BTL1 draws: pre-prepared personal reference material is fine, live AI assistance during the timed practical generally isn't. If your specific exam invite says otherwise, defer to that over this general note.
Genuinely new material relative to the INE curriculum — INE's Web App section stops at recon/CMS testing, while this path covers the actual vulnerability classes hands-on. Three worth knowing cold since they don't appear anywhere else in your course list:
| Vulnerability | What it is | How you'd spot it |
|---|---|---|
| IDOR (Insecure Direct Object Reference) | An ID/reference in a URL or request that isn't authorization-checked — change ?id=1042 to ?id=1043 and see someone else's data | Any endpoint with a sequential or guessable ID parameter — try incrementing/decrementing it |
| SSRF (Server-Side Request Forgery) | You supply a URL, and the server fetches it — abuse this to hit internal-only services or cloud metadata endpoints (169.254.169.254) | Any feature that fetches a URL you provide — image-from-URL, webhook config, PDF generation from a link |
| Command Injection | User input reaches a shell command unsanitized — ; whoami or && id appended to an input field executes on the server | Any feature that shells out internally (ping tools, file conversion utilities) — test with command-separator characters |
INE's Web App section only briefly touches Burp for passive crawling — this path is where you actually learn to use it as your primary manual testing tool, which is how it's used in practice far more than automated scanners alone.
| Tab | What you use it for |
|---|---|
| Proxy | Intercept and inspect every request/response between your browser and the target — the foundation everything else builds on |
| Repeater | Take one captured request, modify it, resend it repeatedly — your main tool for manually probing a single parameter (SQLi test, IDOR test, etc.) |
| Intruder | Automate sending many variations of a request — brute force a login, fuzz a parameter with a wordlist, spray a token |
| Extensions (BApp Store) | Community add-ons — e.g. a dedicated SQLi scanner or a JWT-editing tool bolted onto Burp itself |
Mostly reinforcement of material already covered above — flagged items below are the exceptions genuinely worth extra attention.
This entire module is genuinely new relative to the rest of your curriculum — AD attacks don't appear anywhere in the INE eJPTv2 list you shared. Given AD environments are extremely common in real engagements (and the domain most likely to show up if your exam includes a Windows domain scenario), this is worth real depth, not a skim.
| Stage | What it covers | Why it's ordered this way |
|---|---|---|
| Breaching | Getting a first foothold into the domain — a captured credential, a vulnerable service on a domain-joined host | Everything downstream needs at least one valid domain account, even a low-privileged one |
| Enumerating | Users, groups, computers, trusts, ACLs — usually via BloodHound-style collection | Turns "I have one account" into a visual map of every path toward Domain Admin |
| Lateral Movement & Pivoting | Moving from the host you're on to others in the domain | Real AD compromises are rarely a single host — they're a chain |
| Exploiting | Kerberoasting, ACL abuse, delegation abuse, and similar AD-specific attack primitives | Where the actual privilege escalation inside the domain happens, distinct from single-host privesc |
| Persisting | Maintaining access even if the initial foothold is remediated | Standard for a full engagement — less likely to be exam-relevant depending on scope, but conceptually important |
| Credentials Harvesting | DCSync, ticket extraction, LSASS dumping at scale | The payoff step — this is what actually gets you Domain Admin-equivalent access |
The Active Directory basics card in your Study Reference's Quick Reference covers the fast-lookup command syntax (enum4linux-ng, crackmapexec, BloodHound, Kerberoasting) — this module is where you'd build the conceptual map that makes those commands make sense as a chain rather than isolated tricks.