eCPTX: The Honest Review



You can join the eCPTX telegram group from here:

On June 17th, 2022, I successfully completed the eCPTX exam from eLearnsecurity and received my certification. At the time, I was working and had a lot of responsibilities, so I didn’t have a chance to study the course material beforehand. Instead, I relied on my previous experience and what gathered & used it during the exam. I will now provide an honest review of the eCPTX overall and in more details than the eCPPT, Cause there are a lot of things. Doesn’t make sense i saw in other ppls review.

Course Content

For the eCPTX course content i was disappointed with a lot of stuff. The content as the following:

  • Penetration Testing: Preparing the Attack
  • Penetration Testing: Red Teaming Active Directory
  • Penetration Testing: Red Teaming Critical Domain Infrastructure
  • Penetration Testing: Evasion

Penetration Testing: Preparing the Attack

In this part it was all about email security and phishing. You will learn about Email security like SPFDKIMDMARC. In addition to phishing attacks and ways to use macros & will show you study cases of macros used by APTs. Finally, C2 and redirectors. You think it’s cool right ? No, Cause if someone have no idea about macros actually or VBAs will not be able to understand and a lot of things will fall while learning. Side by that the module shall teaches you. How to develop Macros to use in your engagement. But, all what i saw was study cases and methods without writing any Macros. So, we can say that this section is showing you knowledge or giving you some knowledge. In the video related to this section, It shows how to get used codes and use it again by modifying it it's Good point but it will be hard to work with the modern solutions. In summary, In my opinion it was gonna better to teach how to develop macros from scratch up to advanced level as this certificate under the Red Teaming part. But, it still have good topics like the redirectors, But also still not everything explained clear in this section. But, at all if you are familiar with these topics and have previous knowledge about it you gonna find that it’s all fine with you.

Penetration Testing: Red Teaming Active Directory

I can say the real fun starts here as this section doesn’t have a lot of unclear things. But, in my opinion the only thing that i didn’t like is that in the first part in this section which was Advanced Active Directory Reconnaissance & Enumeration. They didn’t cover what is active directory first or it’s basics. But, it’s in the second part/pdf. So it shall be in the first PDF. But, it discuss how to start enumerate and obtain information from non-joined machine which is something good & Also attacking joined Linux machine in the AD, which is not common for people to talk about. In the second PDF which is Red Teaming Active Directory it was cool actually and here started by explaining The Active Directory environment, Moving to the Attacks of tradntial Active Directory attacks like LLNMR PoisoningDowngrading NTLM and more.Then talking about Powershell defense and bypasses, Abusing active directory features and components, Moving laterly, Browser Pivoting and many more.

Penetration Testing: Red Teaming Critical Domain Infrastructure

This section talking about used components and services in windows like MS ExchangeWSUS & MSSQL. it does not have that much of information but it’s fine to learn from it and you can find other blog series online talking in much more details would help you also you could find online abusing for something like SCCM.

Penetration Testing: Evasion

In this section explained about the AMSI architecture and some bypasses moving to other methods and components like Sensitive groups that solutions can use it for detection, also other solutions like EDRs and techniques to bypass and evading, After that developing a custom payload which i can say is a good one. Finally, The most section i liked in the course is the second section and i explained why. My final words is if the course relied on using and abusing built-in commands, functions and features for abusing as example, It would be absolutely an amazing content as it will reduce the detection in the real-world engagement.

The Exam

Now, Let’s talk about the exam. But, before this i mentioned something and its when i searched for reviews for the eCPTX, I found one thing common between most of the people that go through the exam, Which is some of them fail cause they had to find 3 paths or 3 ways to access the targeted domain, But, the funny part here if you go through the RoE (Rules of engagement) You can clearly see in the document that it’s telling one of the rules to pass the exam is to identify 3 ways to access the targeted domain. And others saw it as a really hard exam. But at all, As i mentioned before i toke the exam and passed without studying the content (That doesn't mean i am 1337 "elite" I'm giving my opinion honestly and what i see from my point of view), You may find content so wow and amazing, Therefore, th exam will be extremely hard. But, no exam was normal and if you have deal with .net stuff and reverse some of it it would be easy for you. For me i was reversing the .dll files from unity games in the past to modify it. So, I can say exam was normal not too easy and not too hard & It’s really was gonna be hard if we applied all what the content teach and i would be failing in it. For the exam environment you would face some issues, For example, you could try to abuse an attack, But will not work and when you restart the exam lab, the try again. It will work. At the end Thanks for taking to read and if you want to add books to read i would recommend books like Anti-Virus Bypass techniquesThe Hacker Playbook 3Advanced Infrastructure Penetration Testing .


Red Team Infrastructure & Macros

Active Directory and lateral movement

Attacking MSSQL, WSUS, Exchange and SCCM


Published by Zeyad Azima

A technical person working in cyber security & interested in computer sciences in general and low-level(Brain-Storming) Stuff like: Vulnerability Research & Exploit Development, Malware Analysis, Reverse Engineering. Understand it, Do it & Break it.
Talks at: "Top Universe" | "Unimy"
Technical Certificates: eCPTX | eMAPT | eCPPT | eJPT
Non-Technical Certificates: TOEFL IBT