EJPT Cheat Sheet 2026

The 30 highest-yield EJPT facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is process migration in Meterpreter used for? → Moving the Meterpreter session into a different running process
2. What is a 'staged' payload in Metasploit? → A small first-stage stager that downloads the larger payload from the attacker
3. What is the function of the Metasploit module 'exploit/multi/handler'? → Listens for incoming connections from reverse payloads
4. What is a rainbow table attack? → A precomputed table of hash-to-plaintext mappings used to reverse hashes quickly
5. Which tool is commonly used to capture and analyze network packets during a host audit? → Wireshark
6. What is the purpose of the 'unshadow' command in John the Ripper? → It combines /etc/passwd and /etc/shadow into a single crackable file
7. Which vulnerability class is described as 'a flaw that allows attackers to redirect users to malicious sites via a trusted application'? → Open Redirect
8. What technique does 'Pass-the-Hash' exploit to authenticate to Windows services without knowing the plaintext password? → Using the captured NTLM hash directly for authentication
9. What is the primary function of Netcat (nc) in penetration testing? → Read and write data across network connections for various purposes
10. What is the eJPT certification? → An online penetration testing certification
11. What Meterpreter command shows information about the current user on the compromised target? → getuid
12. What information does the 'searchsploit' tool help a penetration tester find? → Local copies of public exploits and shellcodes from Exploit-DB
13. During a vulnerability scan, you find an open port 445 on a Windows host. Which vulnerability should you prioritize checking for? → EternalBlue (MS17-010)
14. What is the primary purpose of analyzing ICMP traffic during a penetration test? → Host discovery and network mapping
15. Which HTTP status code typically indicates that a resource exists but the user is not authorized to view it, which can be useful during enumeration? → 403 Forbidden
16. Which of the following is the PRIMARY purpose of the Common Vulnerability Scoring System (CVSS)? → To offer a standardized framework for rating the severity of vulnerabilities.
17. What tool can you use to document your work during the exam? → CherryTree
18. Which 802.11 management frame type is commonly spoofed to forcibly disconnect wireless clients from an access point? → Deauthentication frame
19. What does a CVSS score of 9.8 indicate about a vulnerability? → Critical severity requiring immediate attention
20. What tool does the course focus on using efficiently? → nmap
21. Which wireless encryption protocol is considered completely broken due to its weak IV implementation and can be cracked within minutes? → WEP
22. What is the main purpose of a network topology map during an audit? → To visualize the relationships and connections between hosts in the network
23. What is the purpose of the CVSS score in penetration testing reports? → To standardize the severity rating of vulnerabilities on a numeric scale
24. Which hash format does Windows NTLM use? → MD4
25. What is the primary risk of an 'Insecure Direct Object Reference' (IDOR) vulnerability? → Accessing or modifying other users' data by manipulating object identifiers
26. Which command-line tool on Linux can be used to display active network connections and listening ports? → netstat -an
27. What type of attack involves sending a large number of SYN packets without completing the TCP handshake? → SYN Flood
28. Which Burp Suite tool is best for automatically testing all parameters in a web request for common vulnerabilities? → Burp Scanner
29. What does the 'background' command do in an active Meterpreter session? → Sends the session to the background while keeping it alive
30. Which technique involves sending specially crafted packets to determine if a host is filtering, closed, or open on specific ports? → Port scanning