The eJPT certification is the cert most people point new hackers toward, and for good reason. It costs a fraction of the big names, the exam is entirely hands-on, and there are no multiple-choice trivia questions asking you to recite the phases of an attack. You break into a network, you answer questions based on what you actually found, and you either got the flag or you did not.
This guide covers what the eJPT tests, what it costs in 2026, how the 48-hour exam works, and a realistic prep plan to get you there. If you want to build the enumeration and exploitation muscle the exam expects, work through a real target in our network penetration testing course as you read. This article is part of our pillar resource on cybersecurity certifications, where we break down every credential worth your time and money.
TL;DR: The eJPT is a $249 entry-level penetration testing certification from INE Security (formerly eLearnSecurity). The exam is a 48-hour, fully hands-on lab with 35 questions tied to what you exploit, a 70% pass mark, and one free retake. It has no prerequisites, never expires, and is the best first cert for proving you can actually enumerate and exploit a network rather than just talk about it.
📊 eJPT Quick Answers
📑 In This Guide
🎯 What is the eJPT Certification?
The eJPT (eLearnSecurity Junior Penetration Tester) is an entry-level, fully practical penetration testing certification issued by INE Security. It proves you can enumerate a network, find vulnerabilities, and exploit them to reach a goal, without any theory-only questions.
The current version, eJPTv2, launched in March 2022 and replaced the old paper-style exam entirely. INE Security is the successor to eLearnSecurity, which is why you still see the "e" prefix on the name. The cert sits at the bottom of INE's penetration testing track, below the eCPPT and the eWPT, and it is built for people who have never sat a hands-on security exam before.
What makes it stand out is honesty about difficulty. The eJPT does not pretend to be OSCP. It will not throw a buffer overflow or a heavily chained privilege escalation at you. It checks whether you can run an Nmap scan, read the output, pick the right exploit, pivot through a subnet, and pull off basic web and network attacks under time pressure. That is exactly the skill set a junior on a real engagement needs on day one.
Why it matters: Most entry certs (Security+, CEH) test what you can recognize on a multiple-choice screen. The eJPT tests what you can do at a keyboard. For a first offensive-security credential, that difference is everything when a hiring manager reads your resume.
📋 eJPT Exam Format and Structure
The exam drops you into a live lab environment over a VPN and gives you a scenario, the kind of "letter of engagement" you would get from a real client. From there, it is entirely up to you to find and exploit your way to the answers.
The Key Numbers
- 48 hours, self-paced You get two full days from the moment you start. There is no requirement to finish in one sitting, so you can sleep, eat, and come back with fresh eyes.
- 35 questions tied to the lab Questions are dynamic. You cannot answer them without doing the hands-on work first, and each candidate's lab uses a mix of dynamic and static flags to stop write-up copying.
- 70% to pass You need to answer 70% of the questions correctly. Get stuck on one host and you still have room to pass on the rest.
- Open book, unproctored No webcam, no lockdown browser. Use your own notes, Google, and any tools you want. It mirrors how real testing actually works.
What the Exam Covers
The eJPTv2 exam blueprint splits across four domains. Weighting tells you where to spend prep time:
- Host and Network Penetration Testing (35%) The largest chunk: exploiting services, gaining a foothold, pivoting between subnets, and using Metasploit effectively.
- Assessment Methodologies (25%) Information gathering, footprinting, scanning, and enumeration. The unglamorous work that determines whether you find anything at all.
- Host and Networking Auditing (25%) Understanding hosts, networking fundamentals, and reading what services and configurations tell you about a target.
- Web Application Penetration Testing (15%) The basics: SQL injection, directory enumeration, and common web flaws you can reach from the network.
The trap everyone falls into: pivoting. A big share of eJPT failures come down to candidates who own the first machine, then never realize there is a second internal network behind it. If a compromised host has two network interfaces, you are meant to route through it. Practice pivoting until it is second nature.
💰 eJPT Cost and Training Options
Pricing is where the eJPT gets interesting, because the exam and the training are sold in two different ways and one of them is a much better deal.
| Option | Price | What You Get |
|---|---|---|
| Exam voucher only | $249 | One exam attempt plus one free retake. No training included. |
| INE annual subscription | $299/year | The full PTSv2 training path, all lab time, and the exam voucher bundled in. |
Do the math. The standalone voucher is $249. For $50 more, the annual subscription throws in the entire Penetration Testing Student (PTSv2) learning path plus lab access. Unless you already have solid pentesting fundamentals, the subscription is the obvious pick. You get the course that was built to pass the exam, not just the exam.
Voucher timing: Vouchers are valid for 180 days from purchase. The free retake has to be used within 14 days of a failed attempt and before the voucher expires, so do not fail on day 179 and expect a second shot.
The Included Training (PTSv2)
INE's Penetration Testing Student path is the official prep. It is genuinely beginner-friendly and starts with networking review before touching a single exploit. The core sections cover:
- Assessment methodologies: footprinting, scanning, and enumeration workflow
- Host and network auditing: Windows and Linux fundamentals for attackers
- Host and network pentesting: Metasploit, exploitation, and pivoting
- Web application pentesting: SQL injection, directory brute-forcing, and common flaws
👤 Who Should Take the eJPT?
The eJPT sits in a specific slot: the first hands-on cert you earn after learning the basics. It is not the right move for everyone.
Ideal Candidates
- Career switchers moving into security who need one concrete, practical credential to point at
- Students and self-taught learners who have watched the videos and want to prove they can actually do it
- Help desk and IT support staff pivoting toward a SOC or junior pentest role
- Anyone eyeing OSCP who wants a lower-stakes warm-up before spending four figures
Recommended Background
There are no formal prerequisites, and INE means it. But you will have a far smoother time with a few things already in place:
- Comfort in a Linux terminal (moving around, editing files, running tools)
- Basic networking: IP addresses, ports, TCP vs UDP, subnets
- Familiarity with Nmap and reading its output
- A rough idea of how HTTP and web requests work
Maybe Skip It If
If you already hold OSCP, PNPT, or you have been paid to run engagements, the eJPT will not teach you anything new and will not add much to your resume. It is a junior cert by design. In practice, mid-level pentesters who take it usually do so to clear it off a training-budget list, not for the skills.
⚔️ eJPT vs OSCP vs Security+: Which First?
These three get compared constantly because they are the usual candidates for a "first cybersecurity cert." They are not really competitors, though. They test completely different things.
| Aspect | eJPT | OSCP | Security+ |
|---|---|---|---|
| Provider | INE Security | Offensive Security | CompTIA |
| Price | $249 | $1,749+ | ~$400 |
| Format | Hands-on lab | Hands-on lab | Multiple choice |
| Exam length | 48 hours | 24 hours | 90 minutes |
| Difficulty | Beginner | Advanced | Beginner |
| Free retake | 1 included | None | None |
| Expiration | Never | Never | 3 years |
The Honest Recommendation
- Want a pentest job? eJPT first, then OSCP when you are ready. The eJPT proves practical skill; OSCP clears HR filters.
- Targeting a SOC, GRC, or defensive role? Security+ is the box most of those job postings tick.
- Want realistic methodology plus a client debrief? Look at the PNPT, which sits a level above eJPT in difficulty and cost.
Skip CEH for this decision. It costs several times the eJPT, leans heavily on multiple-choice theory, and does not prove hands-on ability the way a live-lab exam does.
📚 How to Prepare for the eJPT
Most people clear the eJPT with 4 to 8 weeks of focused study if they start from a basic technical background. Here is a structure that works.
A 6-Week Plan
| Week | Focus |
|---|---|
| Weeks 1-2 | Networking and Linux fundamentals. Work through the PTSv2 methodology sections until scanning and enumeration feel routine. |
| Week 3 | Nmap deep dive plus service enumeration. Learn to read a scan and know what to attack next. |
| Week 4 | Metasploit and exploitation. Get comfortable finding, configuring, and firing modules against a target. |
| Week 5 | Pivoting and web basics. Route through a compromised host into a second subnet; practice SQL injection and directory brute-forcing. |
| Week 6 | Full practice engagements end to end. Build a note-taking template and rehearse the whole workflow under time. |
Skills That Show Up on Every Attempt
Scanning and Enumeration
This is 25% of the exam and the foundation for everything else. You should be able to run an
Nmap 7.94 sweep, spot open services, and immediately know your next move. A quick command like
nmap -sC -sV -p- 10.10.10.5 should feel automatic. Keep our
Nmap cheat sheet open in a
tab while you practice.
Metasploit
The eJPT leans on Metasploit far more than OSCP does. Learn to search for modules, set options, handle
payloads, and use autoroute and the SOCKS proxy modules for pivoting. This is not
considered "cheating" here; using the framework well is part of what the exam checks.
Pivoting
Say it again because it fails more candidates than anything else: after you own a host, check its
network interfaces with ifconfig or ip a. A second interface means a second
network you are expected to reach. Practice setting up a route and scanning through the compromised box
until it is muscle memory.
Web Fundamentals
The web portion is only 15% and stays basic. Know how to find hidden directories, spot and exploit a simple SQL injection, and read a web app for obvious flaws. If you want to drill SQL injection specifically, our Query Quake lab walks you through UNION-based injection hands-on.
The one habit that passes the exam: take notes obsessively. Log every host, every open port, every credential, and every interface as you go. When a question asks for the hostname on a machine you rooted six hours ago, good notes are the difference between a quick answer and a frantic re-scan.
💎 Is the eJPT Certification Worth It?
For the right person at the right stage, the eJPT is one of the best-value certs in security. Here is the honest breakdown.
The Good
- Cheap for what it proves: $249 for a hands-on cert versus $1,749+ for OSCP
- Actually practical: you exploit real machines, not answer trivia
- Low pressure: 48 hours, open book, one free retake, no proctor watching you
- Beginner-friendly: genuinely designed for people with no exam experience
- Never expires: earn it once, keep it for life
The Limitations
- Junior recognition: it gets you noticed for entry roles, not senior ones
- Not OSCP: some job postings still filter specifically for OSCP and will not count eJPT
- Metasploit-heavy: great for the exam, but you still need to learn manual exploitation for harder certs later
- Adds little for experienced testers: if you already work in the field, skip it
The Career Reality
The eJPT will not, on its own, land you a senior pentest salary. What it does is get an entry-level resume past the first filter and give you something concrete to talk about in an interview. When a hiring manager sees eJPT, they know you have sat in a lab and broken into something, which puts you ahead of every applicant whose experience is watched-videos-only.
The verdict: If you are new to offensive security and want to prove you can do the work, the eJPT is close to a no-brainer at $249. Take it, then use it as the launch pad for OSCP or PNPT once you have the fundamentals locked in.
❓ Frequently Asked Questions
How much does the eJPT certification cost?
The eJPT costs $249 for a standalone exam voucher, which includes one free retake. Alternatively, INE Security's annual subscription is $299 and bundles the full PTSv2 training path and lab access along with the exam, making it the better value for most beginners.
How long is the eJPT exam?
You have 48 hours to complete the exam. It is a self-paced, hands-on lab with 35 questions tied to what you discover and exploit. You do not have to finish in one sitting, so you can rest and return.
What score do you need to pass the eJPT?
You need 70% to pass. Questions are weighted across four domains, with Host and Network Penetration Testing carrying the most weight at 35%.
Are there prerequisites for the eJPT?
No. There are no formal prerequisites. That said, basic Linux comfort, networking knowledge, and familiarity with Nmap will make the exam much smoother.
Does the eJPT certification expire?
No. The eJPT is a lifetime credential. Once you earn it, it never expires and there are no recertification fees.
Is the eJPT harder than OSCP?
No, the eJPT is considerably easier. It is a beginner-level exam that relies heavily on Metasploit and does not include advanced privilege escalation or buffer overflows. Most people take the eJPT first and pursue OSCP later.
Can I use Metasploit on the eJPT exam?
Yes. The exam is open-book and all tools are allowed, including Metasploit. Using the framework effectively is part of what the eJPT tests, unlike OSCP, which limits Metasploit use.
⚖️ Legal and Ethical Considerations
The skills you build for the eJPT are the same ones attackers use. Keep them pointed at systems you are allowed to touch.
Critical reminder: Always get explicit written authorization before testing any system. Unauthorized access is illegal and can lead to criminal charges, fines, and permanent career damage. "I was just practicing" is not a legal defense.
- Only test systems you own or have written permission to test. The eJPT lab, your own home lab, and dedicated practice platforms are the legal places to sharpen these skills.
- Use legal practice environments. HackerDNA Labs and INE's exam environment are both built for exactly this.
- Practice responsible disclosure. If you find a real vulnerability outside a lab, report it through proper channels instead of exploiting it.
- Respect scope. On real engagements, staying inside the agreed boundaries is what separates a professional from a liability.
Last verified: July 2026. Pricing and exam details confirmed on INE Security's eJPT certification page.
🚀 Your Next Steps
The eJPT certification is the most efficient way to turn "I have watched some hacking tutorials" into "I have broken into a network and can prove it." It is affordable, fully hands-on, forgiving with its free retake, and it never expires. For a first offensive-security credential, little else comes close on value.
Your roadmap: lock in networking and Linux basics, work through the PTSv2 path, drill enumeration and Metasploit until they are automatic, master pivoting, then rehearse full engagements under time before you book the exam.
Start Here Based on Your Level
- Total beginner Get the fundamentals down first with guided challenges in Learning Lab 101 before touching exam prep.
- Know the basics Build the exact enumeration-to-exploitation loop the exam wants in our network penetration testing course.
- Already comfortable Run timed practice engagements, tighten your notes, and book the voucher. You are probably closer than you think.
Start practicing in the browser today, no VM or VPN setup required, on HackerDNA's free tier. Build the hands-on skill the eJPT rewards, then go earn the cert that proves it.
Part of the Cybersecurity Certifications series
Related articles:
