eLearnSecurity Certified Professional Penetration Tester (eCPPT): Overview and How to Prepare for the Exam

Three Experiences from our Offsec Team

Evan Isaac’s Experience (connect with Evan)

During the studying phase of the exam, I was mainly focused on buffer overflows and pivoting. These two vectors of network penetration testing were new to me. After practicing for about two months on both, I was prepared for the exam.

The exam has you start off with some basic enumeration and gradually requires you to jump into the deep end of network pen testing. They challenge you to know the skills behind what was taught in the course material including privilege escalation, buffer overflows, web application vulnerabilities, pivoting and much more. After studying for a long period of time, I saw patterns in the exam, which led me to complete it in under 24 hours.

The objective of the exam is to not only hack the network, but to write a professional report. After I compromised the entire network, I decided to go back to the start, and start it again with a different mindset. This helped me discover additional vulnerabilities in the network.

Your job as a penetration tester is to find as many vectors as possible in the machine. So, if you finish the exam in a short period of time, just remember that there are probably vulnerabilities that you missed.

One downside to the exam for me was the instability of the lab environment. While attempting to obtain shells on various machines, the shell you were on would die. This was a bit frustrating because I would need to backtrack and do it again.

Additionally, when trying to perform a buffer overflow, it was unsuccessful numerous times. After the 5^th attempt, I decided to reset the lab environment. Once the environment was restarted, I ran my script again, and obtained a shell through the buffer overflow right away.

Overall, I believe this is a great certification for people to learn network penetration testing. You will learn a lot, and I suggest using a note-taking application, such as Obsidian, to write everything down. You will find stuff on the exam, where if you do not have your notes, you may get lost on what to do next.

On a scale of 1-10, I would give the exam an 8 out of 10. I rate it an 8 because of the instability I faced in the exam environment.

Kris Johnson’s Experience (connect with Kris)

After purchasing the “BOOGO” sale in October of 2022, which is one of the greatest deals INE offers, I immediately began studying. Based on the advice I received from others regarding the test, I knew it would be beneficial for me to focus my studies on topics such as buffer overflows and double network pivoting. Gaining a better understanding of these concepts helped me understand how to move around the network and obtain a session on one of the machines.

Throughout the course offered by INE/eLearnSecurity I found that a lot of the material was outdated, not to say that it is not helpful, but it could use an update. Nonetheless, I went through the entire course, took plenty of notes and then after completing the course I found plenty of TryHackMe rooms that would help me prepare for the exam.

Remember, this is a practical exam. Knowing the concepts of an attack versus putting hands on a keyboard are very different, and it is always important to understand a concept in both senses.

Overall, I found the exam to be comfortable, but some parts proved to be challenging, such as buffer overflow, privilege escalation, and getting certain exploits to work as intended. To overcome these difficulties, I made a conscious effort to continually research and identify potential vulnerabilities that I might have overlooked.

Fortunately, the exam environment was very stable for me, with the only issue I encountered being a problem with the buffer overflow, where my meterpreter session would terminate after about five minutes.

In terms of difficulty, stability, reporting, time given for reporting, and the practical section, I would rate the exam a 9 out of 10 based on my personal experience.

Jake Murphy’s Experience (connect with Jake)

I began studying for the eCPPT after about a year and a half of real-world pen testing experience. Most of what I’ve learned in the network pen testing field has been discovered or taught on the fly, so I was really looking forward to filling in some of the gaps that inevitably develop when self-taught.

Three of the sections I really enjoyed (and took a lot from) were pivoting/double pivoting, buffer overflow, and the basics of privilege escalation. After a couple of months of studying, I felt I was ready for the exam.

After starting the exam, I was able to gain access to the first server and started making some steady progress. That is until I was stumped on a very basic part of the exploit process (know your payloads!). Once I realized my mistake, I continued until I was stuck once again! As it turned out, the answer was right in front of me the whole time, as I was chasing exotic exploitation/escalation payloads. This was the break I needed as I proceeded to finish the exam.

Overall, I would rate the exam a 7.5 out of 10. I learned a lot from it (especially with pivoting/double pivoting) and would recommend it to anyone trying to get their start in Offensive Security.

As for improvements, I would like to see the content refreshed as some of it is currently outdated. Additionally, host stability was an issue at times, which can make exams extra frustrating for testers.

In the end, the eCPPT was well worth the time invested into it and I still occasionally reference my notes on my client engagements.