Passed eJPT and eCPPT With OSCP Materials

Sch1sm

Questions about how these courses relate seem to be pretty common here so hopefully I can help a few people out.

I've recently passed both eJPT and eCPPT (eCPPT has literally just been updated and I sat the old version, however I think the general level of the exam shouldn't be too different) after completing 90 days in the PWK/OSCP labs.
I didn't use any of elearnsecurity's course materials but I have heard they're pretty decent. I decided to just take the chance and hope that my experience from the PWK labs would be enough and thankfully it was.

eJPT
Pretty easy, took about 4 or 5 hours but you get a lot more time iirc. You attack a network and then answer questions based on the machines and find out your results straight away. It is a junior level course so I think this would be great to go for if you have zero experience and would like to start out with a practical course. If their materials are as good as I'm led to believe this would be a good starting point for an absolute beginner. However I personally value practical experience a lot more than multiple choice certs and that view may not necessarily be shared by potential employers - these certs aren't very well recognised (yet?).

eCPPT
This exam was a lot more challenging, some aspects of it surprised me because I wasn't expecting it to be as advanced. It's definitely much easier than the OSCP exam but you still need to have some decent pentesting knowledge to be able to pass. You're graded based on the report you write. Preparing for OSCP helped me massively for this because I just used the same format and I was used to taking a lot of screenshots. The report requirements are pretty vague and there's also no template to work from. One frustrating aspect of this exam is it can take up to 30 business days to get your marks back. Some people have said they got their results after a few days but I had to wait 3 weeks, which was annoying. You also get a free resit which is very useful. I missed a required vulnerability (even though the only stated requirement on the exam materials is to root a certain server, which I did) on my first attempt but you get some good feedback for what to improve for your second attempt.

If you have the money and time I think going from eJPT, eCPPT then to OSCP would be a very good path. Diving into OSCP can be frustrating and overwhelming, especially considering their material isn't the best. eJPT is probably skippable depending on your level of experience but eCPPT definitely requires you to know a fair bit. I think anyone with similar PWK lab experience as me would be able to pass both of them without too much trouble so it's worth just going for the exam and skipping the materials if you want to add some more certs to your resume/CV.

If anyone has any questions feel free to drop them in here and I'll hopefully be able to answer them.

xXxKrisxXx

Hey Sch1sm. Loved this post and agreed with a lot of it. I also think people looking to go after the OSCP should just mainly factor in the amount of time they have to commit to the labs and their will power to succeed. The OSCP Exam is more Capture the Flag based and the eCPPT seems a bit more in line with a penetration test. If someone has taken PWB/PWK and obtained the OSCP, they shouldn't have much of a challenge getting their eCPPT. It's my opinion the exams for both should change every so often. There's been so much put out there online about the current OSCP challenge that a lot of people know what to expect for the most part.

The most difficult part I found about the eCPPT was the Report. They weigh this very heavily and they're super vague. You could find decent report templates out there to model yours off of, but you do have to put a lot of time into writing the report. Objectives can be cleared, but if your report is trash, eLearnSecurity won't pass you. It's because of their report requirements that they give you the second attempt in my opinion. Having taken PWB first at the time, I used the lab report template they give you in the course and made everything look more professional when I submitted my eCPPT report. I know what you mean about having to wait - it does get a little annoying. Especially if you know you missed an objective or your report isn't going to pass and you're itching to re-try. My opinion is if you want the eCPPT and already have your OSCP, just pay $200 and challenge the certification exam.

In terms of exam difficulty, I found both of them somewhat comparable. I agree the eCPPT may be a bit easier, but if you look on eLearnSecurity's website and compare it with the OSCP, you'll see that a lot of the exam objectives overlap in a way. What makes the OSCP so nerve racking is that you're given 24 hours and what makes eCPPT more chill is that you're given a week for the exam (and I believe a week for the report). Regarding recognition - I don't see the eJPT catching on for a very long time. It's not because the challenge isn't there, it's just when you come across Jr Security Consultant Roles, organizations know that people with an OSCP or a GPEN are obviously going to stand out more over someone who's certification has, 'Junior' in the title. This doesn't de-value the course, but my opinion is go out there and study the ethical hacking courses on Cybrary before jumping into eCPPT or OSCP.

I see eCPPT listed on a couple of jobs sometimes as a, 'Nice to Have', but it's listed next to the OSCP. My opinion on the eCPPT certification starting to gain little recognition finally after so long is that people in these organizations are sitting for the exam, seeing how it's practical and a good challenge, and they're asking HR to stick it on their job descriptions. The eCPPT certification reputation catching on is more about people having it in the industry and working doing penetration testing work versus it being a money issue like eLearnSecurity says it is. If they say it's a money issue though, it's a money issue.

ZzBloopzZ

Thanks for the write up!

Are you and xXxKrisxXx both pen testers for your day job? Sorry maybe I missed it but you also have the OSCP correct?

Danielm7

Great input from both of you, rep++

NetworkNewb

Great write up. Thank you sir

Sch1sm

ZzBloopzZ wrote: »

Thanks for the write up!

Are you and xXxKrisxXx both pen testers for your day job? Sorry maybe I missed it but you also have the OSCP correct?

Sorry, I meant to clarify this in my original post but I forgot. I haven't passed the OSCP exam, I've failed the exam 3 times now. I did have 90 days in the labs and rooted the majority of the machines though.

The time allowance is definitely a major factor to be fair. If I had to pass eCPPT in 24 hours (like OSCP) I probably wouldn't. The time limit with OSCP is what makes it so hard, everything needs to go pretty smoothly because you don't really have time to work a lot of things out.

UnixGuy

Excellent write up thanks!

Can anyone compare those tests with GPEN?

xXxKrisxXx

@Bloopz - I don't work doing Penetration Testing for my job surprisingly. I've actually been more on the development side. At the time I did the OSCP, i was a community college student who had a lot of time on his hands and had a knack for pen testing.

@UnixGuy - Can't exactly compare the tests even though I've taken all of them (minus the eJPT). The GPEN examination is Open Book Multiple Choice, while the eCPPT and OSCP are more practical non-multiple choice. Just because you're allowed to bring **** sheets and notes in with you for the GPEN doesn't mean you'll necessarily pass. The questions were tough, but the course thoroughly covered the content good enough to make you feel prepared for the exam. I obtained the GPEN in 2014 and the exam has changed a bit since then. For example, they used to have Wireless Attacks in the course and on the test.

Majority of SANS courses, especially the popular ones are updated quarterly with the latest and greatest material. This leads to the exam being updated every now and then. You're now tested on powershell which is very relevant (was back in 2014 too), and they cut the wireless stuff out. The exam objectives are looking similar but different than when I took the course. Regardless if the GPEN is open book or not, GIAC certifications have held their reputation and are well known. The GPEN has been around awhile and you're going to see it and the OSCP as pluses for penetration tester roles. I can't vouch for SEC560 enough. Ed Skoudis has really done a fantastic job with putting together the material. The labs are great, practical, and up-to-date. The course used to come with a capture the flag to wrap up the last day. If students were taking the course Live, they'd compete on the last day for a Challenge Coin. Self-Study students were given VPN access to a vulnerable network where they could attack machines configured with certain vulnerabilities at their own pace. This is the same challenge as far as I know. Main difference is if you're in the class you're likely paired up with people next to you going against other teams. If you're self study, you're going through it at your own pace and get more than a day.

If you're more interested in information more examination specific, the GPEN test is always going to have the most relevant content on it period. SANS stays on top of updates so the course material is always going to have what's hot in the industry at the time and what's frequently/effectively being used. eLearnSecurity and Offensive Security haven't changed up their certification exams in years. It doesn't make them easy by any mark, it's just their certification exams are a good way to gauge the student has learned the material. The GPEN of course gauges this, they just update their courses more frequently. For example, maybe you'd walk into the eCPPT challenge and not have to face anything like a Powershell Script versus you'd have to know some Powershell in order to answer a handful of questions for the GPEN exam.

DAVIS NGUYEN

Congrats!

bluesquirrel

@xXxKrisxXx
many thanks for sharing such priceless information! After reading different threads on OSCP, it looks like the OSCP study material is somehow incomplete and students are supposed to find the missing pieces by themselves via Google. Does the GPEN study material contain everything which is needed (from the theory point of view) to pass the OSCP exam?

Thanks in advance!

xXxKrisxXx

You're welcome. The short answer is no. To try to summarize, although there may be content overlap, the OSCP exam is entirely practical and hands-on. You're going to have labs in the SEC560 course, but you're not going to be able to necessarily challenge the OSCP and pass if you have your GPEN. It's been known to be quite the contrary. I've heard of people who have earned their OSCP and challenged the GPEN and ended up passing it. I tried this out back in late 2011 having earned the OSCP in summer 2010 and came up a little short. The exam objectives at the time were a bit different that the OSCP. If you look at the GPEN exam topics and course content of SEC560, it's closer to what PWK teaches these days than it ever has been.

I think the ultimate network penetration testing course would be combining the content of Pentesting with Kali and SEC560. Compare what the 2 teach on your own time to determine what pieces are missing in one over the other. If you take PWK, you're definitely going to have to Google around. Research is all apart of the process and when you're able to pop a box after searching/trying a few things over some time, you actually get more of a feeling of accomplishment.

Ertaz

So, GPEN as a paid course is a good preparation tool for OSCP? October can't get here soon enough.

xXxKrisxXx

Saying GPEN is a good preparation for the OSCP is stretching it a bit. I'd never recommend taking a $5000-6000 course in preparation for a $900 course. A good preparation tool for OSCP is PWK, hands down. A lot of people I notice here are taking a lot of preparation courses for the OSCP (eJPT, eCPPT, etc) when honestly what they need to do is just buckle down, purchase enough lab time and hit the course hardcore. I'm not saying the content of these courses are useless when preparing for the course, I am saying the content of PWK is good preparation for the OSCP. Tack this on with research and hands-on lab time and this is the best preparation for the OSCP exam that you'll ever have.

I walked into PWB with an open mind, time on my hands, a little bit of hacking experience, no certifications and will power. You could do it too. Cheapest solution prep for this course are the hacking courses on Cybrary (primarily Advanced Ethical Hacking by Georgia Weidman). Couple this with an affordable subscription to Pentester Academy and build your own little lab environment (optionally). The course and exam is hard, but it's totally do-able. Especially now days since there's so many resources out there.

Ertaz

xXxKrisxXx wrote: »

Saying GPEN is a good preparation for the OSCP is stretching it a bit. I'd never recommend taking a $5000-6000 course in preparation for a $900 course. A good preparation tool for OSCP is PWK, hands down. A lot of people I notice here are taking a lot of preparation courses for the OSCP (eJPT, eCPPT, etc) when honestly what they need to do is just buckle down, purchase enough lab time and hit the course hardcore. I'm not saying the content of these courses are useless when preparing for the course, I am saying the content of PWK is good preparation for the OSCP. Tack this on with research and hands-on lab time and this is the best preparation for the OSCP exam that you'll ever have.

I walked into PWB with an open mind, time on my hands, a little bit of hacking experience, no certifications and will power. You could do it too. Cheapest solution prep for this course are the hacking courses on Cybrary (primarily Advanced Ethical Hacking by Georgia Weidman). Couple this with an affordable subscription to Pentester Academy and build your own little lab environment (optionally). The course and exam is hard, but it's totally do-able. Especially now days since there's so many resources out there.

Thank you for the feedback. My work is paying for GPEN in October. I am going to recert my Cisco stuff in the mean time. Maybe after that they'll have $900 they will allow me for the OSCP. Right now my home internet is so slow I can't watch training videos.... (FTTH will be complete this year though)

bluesquirrel

@xXxKrisxXx

thanks one more time for the clarification. My plan would be to start the PWK course in October/November. As I will be without internet access for almost 2 months due to a volunteer project, I am just trying to figure out if there is some good study material I could use during those 2 months to prepare myself properly for the PWK course.

Cheers,

deyavi

bluesquirrel, I would recommend "Penetration testing" book from Georgia Weidman, and also vulnhub machines to practice, reading the walkthroughs when necessary (stuck).

bluesquirrel

@deyavi

thanks for the suggestion! Georgia's book is already on my desk, together with "The Hacker Playbook 2" (which unfortunately contains too much advanced stuff for my knowledge level, unfortunately ). I will start creating my own lab to do some practice, if work allows it

By the way, congratulations for your certifications ... quite impressive list!

jjones2016

xXxKrisxXx wrote: »

Saying GPEN is a good preparation for the OSCP is stretching it a bit. I'd never recommend taking a $5000-6000 course in preparation for a $900 course. A good preparation tool for OSCP is PWK, hands down. A lot of people I notice here are taking a lot of preparation courses for the OSCP (eJPT, eCPPT, etc) when honestly what they need to do is just buckle down, purchase enough lab time and hit the course hardcore. I'm not saying the content of these courses are useless when preparing for the course, I am saying the content of PWK is good preparation for the OSCP. Tack this on with research and hands-on lab time and this is the best preparation for the OSCP exam that you'll ever have.

I walked into PWB with an open mind, time on my hands, a little bit of hacking experience, no certifications and will power. You could do it too. Cheapest solution prep for this course are the hacking courses on Cybrary (primarily Advanced Ethical Hacking by Georgia Weidman). Couple this with an affordable subscription to Pentester Academy and build your own little lab environment (optionally). The course and exam is hard, but it's totally do-able. Especially now days since there's so many resources out there.

Great advice! Thanks again xXxKrisxXx.

jjones2016

deyavi wrote: »

bluesquirrel, I would recommend "Penetration testing" book from Georgia Weidman, and also vulnhub machines to practice, reading the walkthroughs when necessary (stuck).

It makes sense as well. Georgia Weidman training is wonderful. I think I will use this in addition to Pentester Academy... Keeping things low-cost. Thanks again!

varelg

Congratulations on passing and thanks a lot for sharing your experience, Sch1sm. Do you have pentesting as a part of your work?

OmegaNuller

nice write up thanks

Sch1sm

varelg wrote: »

Congratulations on passing and thanks a lot for sharing your experience, Sch1sm. Do you have pentesting as a part of your work?

Nah, I don't do pentesting as my job but I think these certs benefit most people working in infosec. Like I said earlier I value practical experience very highly and doing courses like these help you both in offensive and defensive roles.

I've passed OSCP now aswell so I might try and do a writeup of that soon.