This exam has one purpose: To Differentiate The Experts From The Novices In Penetration Testing!
There are good penetration testers and then there are great penetration testers.
Unless you are bent on being nothing other than the best in penetration testing, don’t bother registering for this program, as you are probably not cut out for it.
We know that the only way to find out what you are made of is by testing you at the brink of exhaustion — which is why the LPT (Master) exam is 18 hours long!
Your pen testing skills will be challenged over three levels, each with three challenges, against a multi-layered network architecture with defense-in-depth controls. You will be required to make knowledgeable decisions under immense pressure at critical stages while selecting your approach and exploits.
As you progress along these levels, you will need to maneuver web application, network, and host penetration testing tools and tricks in an internal and external context to ultimately pwn the hosts and exfiltrate data required for the completion of the challenges.
The exam will require you to demonstrate mastery of deploying advanced pen testing techniques and tools including multi-level pivoting, OS vulnerabilities exploits, SSH tunnelling, host-based application exploits, privilege escalation, web server and web application exploitation such as arbitrary local and remote file upload, SQL injection and parameter manipulation, etc – all in a real life scenario on hardened machines, networks, and applications.
You will be facing the ticking clock and there’s no time to hesitate. There’s no time for second-guessing. Try either of these and be prepared to fail!
And you must know that while you are racing against time, you will be under the watchful eyes of the EC-Council proctors who will be online and live! This added pressure will test your mental strength.
The Advanced Penetration Testing Course by EC-Council was created as the progression after the ECSA (Practical) to prepare those that want to challenge the Licensed Penetration Tester (Master) certification and be recognized as elite penetration testing professionals. Our training has been designed by the best in the industry and meant to push you to develop the kind of skill that you’ve been waiting to acquire.
LPT (Master) training is not comfortable (and the exam is even worse!) , but filled with intense stress meant to illicit the best from you. Those who prevail will have developed an instinctual and intellectual response to real world penetration testing challenges.
We want to bring out the best in you. Our aim is to push you to your limit while making you solve complex problems that actual penetration testers solve daily in the real world. For four punishing and long days, you will have to perform various tasks until it becomes second nature. This is the foundation of the program.
This program is radically different from the ECSA. In the ECSA course, you are provided guidance on what machines to attack and an initial starting point. In the Advanced Penetration Testing Course, you are presented with minimal network information along with a Scope of Work (SOW). The course was created to provide you with advanced concepts that will help when it comes to attempting the LPT (Master) Certification exam.
In this course you will learn professional security and penetration testing skills. The course is designed to show advanced concepts like scanning against defenses, pivoting between networks, deploying proxy chains, and using web shells. The last module of the course includes an SOW for each of the various networks we have created for the course. This, combined with the composition of various ranges, mimics a professional penetration test. Time is limited and you will be required to identify the attack surface followed by the weaknesses of the machines that are on the network.
In summary, only those who possess the burning desire to succeed will make it.
Module 01 Introduction to Vulnerability Assessment and Penetration Testing
Module 02 Information Gathering Methodology
Module 03 Scanning and Enumeration
Module 04 Identify Vulnerabilities
Module 05 Exploitation
Module 06 Post Exploitation
Module 07 Advanced Tips and Techniques
Module 08 Preparing a Report
Module 09 Practice Ranges
Hold an ECSA / ECSA (Practical) or LPT certification in good standing (Your USD100 application fee will be waived);
or Have a minimum of 2 years working experience in pentesting (You will need to pay USD100 as a non-refundable application fee);
or Have any other approved industry certifications such as OSCP or GPEN cert (You will need to pay USD100 as a non-refundable application fee)
The successful candidates need to demonstrate a mastery of the skills required to conduct a full black box penetration test that simulates a complex network of a multi-national organization in real time. The exam environment via EC-Council’s cloud based cyber range, iLabs, has multiple networks with different militarized and de-militarized zones. You will follow the entire process of “Cyber kill chain”, taking you from reconnaissance, scanning, enumeration, gaining access, maintaining access, then exploiting vulnerabilities that you will have to seek out in a network that only a true penetration tester will be able to break.
To build on the technical skills taught in the Certified Ethical Hacking course, the repeatable and documentable methodology provided in the EC Council security analyst program , the EC-Council LPT (Master) course emphasizes application of this methodical approach to penetration testing. The LPT (Master) practical exam thoroughly tests the application of the penetration testing process and lifecycle knowledge and the skills required in an examination that even our reviewers have called “extremely challenging”.
Many have described report writing as one of least preferred, yet arguably one of the most critical parts of any penetration testing engagement. While so many cyber security courses are offered globally to cover various subjects in the penetration testing realm, hardly any are dedicated to this very important skill, especially almost since half of all time spent at any penetration testing engagement can revolve around writing and reporting the core findings of the engagement to the client.
The key skill also lies in communicating a highly technical finding in an elaborate penetration test engagement to someone to the senior management and the board of directors can be very challenging and frustrating at times. Mastery of communication, research and report writing is required to make sense of technically complex topics like specific vulnerabilities and their resulting exploits in a meaningful manner to make educated decisions to improve the security posture of the organization. The candidates are required to submit a comprehensive report of their findings, methodology used, corroborative screenshots, scripts, custom exploits, or any other method they have used to penetrate the network within 45 days after completing the three challenges. The submitted report should be very clear, so that we should be able to compromise the target again by following the report.
