eCPPT Study Plan

A 100% practical pro-level pentest exam, weighted heavily to Active Directory. A free, day-by-day eCPPT schedule built from the official INE Penetration Testing Professional learning path syllabus, scaled to your exam date and weekly hours.

Approx. cost
$599
Difficulty
♥♥♥♥♥
Study time
about 251h
Start level
Intermediate

▶ Build my eCPPT plan

> How long does eCPPT take?

The plan assumes about 251 study hours. Here is how that stretches across different weekly schedules.

Hours per weekTime to finish
5 hoursabout 51 weeks (11.8 months)
10 hoursabout 26 weeks (6.0 months)
15 hoursabout 17 weeks (3.9 months)
20 hoursabout 13 weeks (3.0 months)
30 hoursabout 9 weeks (2.1 months)

> eCPPT exam format

INE Security · INE Penetration Testing Professional learning path

  • Practical exam in an INE lab. Recent candidates report about 24 hours and questions answered from your findings
  • Domain weights: Active Directory 30%, Exploitation & Post-Exploitation 25%, Initial Access 15%, Web 15%, Recon 10%, Exploit Development 5%
  • Voucher valid 180 days, with one free retake within 14 days of a failed attempt
  • INE suggests 2+ years of offensive security experience, though anyone can attempt it
  • eCPPT valid 3 years

Official eCPPT page ↗

> eCPPT syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Warm-up: eJPT-Level Skills

The path builds on basic pentest skills, so make these solid first.

  • Networking, Linux & Windows refresher8h · learn
  • Enumeration, Metasploit & pivoting refresher10h · learn
  • Web vulnerability warm-up (PortSwigger labs)12h · learn

Exam Domains: Recon & Access

Information gathering and the first foothold.

  • Information Gathering & Reconnaissance8h · learn
  • Initial Access14h · learn
  • Web Application Penetration Testing14h · learn

Exam Domains: Exploitation

Turn a foothold into control of the host and network.

  • Exploitation & Post-Exploitation18h · learn
  • Network Security & Service Attacks10h · learn
  • Exploit Development (buffer overflow basics)6h · learn

Exam Domains: Active Directory

The biggest domain at 30%. Put your heaviest practice here.

  • Active Directory Enumeration10h · learn
  • Active Directory Attacks & Lateral Movement18h · learn
  • Command & Control and red team tradecraft4h · learn

Training Grounds

Practice is where this exam is won.

  • INE learning path labs30h · lab
  • Active Directory attack chains (GOAD, HTB, THM)35h · lab
  • Web app labs and boxes12h · lab
  • Mixed boxes with a post-exploitation focus18h · lab

Final Boss Prep

Tools at your fingertips and a method for answering as you go.

  • Tooling cheat sheets (impacket, netexec, BloodHound)6h · review
  • Practice answering findings-based questions6h · review
  • Timed 24-hour mock run12h · review

> Where to practise for eCPPT

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

> eCPPT exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

  • Schedule your exam and add the start time, time zone and deadline to your calendar
  • Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
  • Confirm the current exam format and length in INE’s exam guide, since it has changed recently
  • Record flags, hashes and proof as you go so questions are quick to answer
  • Put your heaviest practice into Active Directory: it is the biggest domain
  • Complete a full-length timed practice run (24 hours if you can) on your exam setup
  • Finalize your note-taking setup and templates (see the notes starter below)
  • Build and review your cheat sheets and command references
  • Arrange time off, tell people you will be unavailable, and plan your meals ahead
  • Confirm whether the exam is proctored and what ID, camera or screen sharing you need

Machine and network

  • Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
  • Plug in your laptop and turn off sleep, updates and notifications for the exam
  • Test the VPN or lab connection early and know how to reconnect after a drop
  • Update your attack VM, take a clean snapshot and keep a spare
  • Install and test every tool you plan to use, and check none of them are banned
  • Test your screenshot hotkeys and make sure you have plenty of free disk space

Proctoring and room (if required)

  • Test your webcam, microphone and screen sharing on the proctoring platform
  • Clear your desk and room as the rules require, and tell housemates not to interrupt
  • Confirm what is allowed at your desk (second monitor, phone, notes, paper) and follow it exactly
  • Learn the rules for breaks and for leaving the camera view
  • Have your ID ready and know the check-in steps

During the exam

  • Sleep well the night before, and skip last-minute cramming
  • Prepare food and water, and set timers for break reminders
  • Read the brief and scope carefully before you touch anything
  • Write notes and capture proof as you go, not at the end
  • Time-box each target and move on when stuck. You can come back later
  • Stop new attacks with enough time left to verify your evidence

Report and submission (if required)

  • Copy your report template and fill in the easy parts (scope, methodology) while you work
  • Check every finding has reproducible steps and screenshots
  • Proofread: could someone else follow each step?
  • Export in the exact format and naming the exam guide requires
  • Submit with a buffer before the deadline and confirm it was received

Suggested exam-day rhythm

  • Hour 0 to 0:30. Connect, confirm the VPN, read the brief and set up your notes.
  • Hour 0:30 to 2. Enumerate everything first. Rank targets by points and how promising they look.
  • Through the day. Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck.
  • Meals. Eat real meals away from your desk roughly every 5 to 6 hours.
  • Around hour 12. Decide on a sleep window of 4 to 6 hours. A rested brain spots what a tired one misses.
  • Last 3 hours. Stop new attacks unless you are very close. Verify proof, collect screenshots and outline the report.
  • After the hands-on part. Write the report in one focused block, proofread, and submit with a buffer before the deadline.

▶ Open the interactive eCPPT exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed eCPPT with PWN PATH

No eCPPT debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Recent eCPPT changes

  1. Site OSIR, eCPPT, eMAPT, CRTE, BTL1: Added five new certs: OSIR, eCPPT, eMAPT, CRTE and BTL1, with a new Mobile app security track on the roadmap.
  2. Data CPTA, eCPPT: Added exam pricing for CPTA (£399) and eCPPT ($599)

Full changelog

> Frequently asked questions

How long does it take to prepare for eCPPT?

PWN PATH builds the eCPPT plan on about 251 study hours. At 10 hours a week that is roughly 26 weeks, and at 20 hours a week roughly 13 weeks. Your own timeline depends on how much of the material you already know.

What is the eCPPT exam like?

Practical exam in an INE lab. Recent candidates report about 24 hours and questions answered from your findings. Domain weights: Active Directory 30%, Exploitation & Post-Exploitation 25%, Initial Access 15%, Web 15%, Recon 10%, Exploit Development 5%. Voucher valid 180 days, with one free retake within 14 days of a failed attempt. INE suggests 2+ years of offensive security experience, though anyone can attempt it. eCPPT valid 3 years.

How hard is eCPPT?

We rate eCPPT 4 out of 5. It suits learners who want a practical pro-level pentest exam weighted heavily to Active Directory. eJPT-level skills. INE suggests 2+ years of offensive security experience, though anyone can attempt it.

How much does eCPPT cost?

Exam voucher price. INE sells its training subscription separately. Check INE for current pricing. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for eCPPT?

Start with the "Warm-up: eJPT-Level Skills" phase: Networking, Linux & Windows refresher, Enumeration, Metasploit & pivoting refresher, Web vulnerability warm-up (PortSwigger labs). The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for eCPPT?

eJPT-level skills. INE suggests 2+ years of offensive security experience, though anyone can attempt it.

What should I do the week before the eCPPT exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the eCPPT exam?

Hour 0 to 0:30: Connect, confirm the VPN, read the brief and set up your notes. Hour 0:30 to 2: Enumerate everything first. Rank targets by points and how promising they look. Through the day: Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck. Meals: Eat real meals away from your desk roughly every 5 to 6 hours.

What should I take after eCPPT?

Common next steps are OSCP+, CRTP. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before eCPPT:

eJPT

Where it leads:

OSCP+CRTP

More in network pentesting:

eJPTCPTAPNPTCPTSOSCP+

Not sure eCPPT is right for you? Take the one-minute cert quiz.