INE Security’s Certified Professional Penetration Tester certification is a practical, hands-on certification exam designed for professional Penetration Testers and Ethical Hackers. The certification exam assesses and validates that the individual has the knowledge, skills, and abilities required to fulfill the role of a modern Penetration Tester.
Exam Objectives
The eCPPT evaluates an individual’s skills across various domains and objectives, certifying their mastery and understanding.
Information Gathering & Reconnaissance (10%)
- Perform Host Discovery and Port Scanning on Target Networks
- Enumerate Information From Services Running on Open Ports
Initial Access (15%)
- Perform Username Enumeration to Identify Valid User Accounts on Target Systems
- Perform Password Spraying Attacks to Identify Valid Credentials for Initial Access
- Perform Brute-Force Attacks on Remote Access Services for Initial Access
Web Application Penetration Testing (15%)
- Perform Web Application Enumeration to Identify Potential Vulnerabilities & Misconfigurations
- Identify and Exploit Common Web Application Vulnerabilities For Initial Access (SQLi, XSS, Command Injection, etc)
- Perform Brute-Force Attacks Against Login Forms
- Exploit Vulnerable and Outdated Web Application Components
- Exfiltrate Data and Credentials From Compromised Web Applications and Databases
Exploitation & Post-Exploitation (25%)
- Identify and Exploit Vulnerabilities or Misconfigurations in Services
- Identify and Exploit Privilege Escalation Vulnerabilities
- Dump and Crack Password Hashes
- Identify Locally Stored Unsecured Credentials
Exploit Development (5%)
- Develop/Modify Exploit Code For Initial Access and Post-Exploitation
- Identify and Exploit Memory Corruption Vulnerabilities (Stack Overflow, Buffer Overflow)
Active Directory Penetration Testing (30%)
- Perform Active Directory Enumeration
- Identify Domain Accounts With Weak or Empty Passwords
- Perform AS-REP Roasting to Steal Kerberos Tickets for Authentication
- Perform Active Directory Lateral Movement Techniques (Pass-the-Hash, Pass-the-Ticket)
- Obtain Domain Admin Privileges/Access
