Domain 1: Engagement Management
- Written authorization (a signed Statement of Work plus a 'get-out-of-jail-free' authorization letter) is the legal prerequisite for any test; without it, activity violates the Computer Fraud and Abuse Act (CFAA) and equivalent laws.
- Rules of Engagement (RoE) define what, when, and how testing occurs: in-scope and out-of-scope targets, test windows, allowed techniques, escalation paths, and emergency contacts.
- Scope documents must explicitly list authorized IP ranges, domains, applications, and infrastructure, plus excluded systems, to avoid touching out-of-scope or third-party assets.
- Agreement types matter: an MSA sets overarching terms, the SOW defines the specific engagement, and an NDA governs confidentiality; black-, gray-, and white-box models set the knowledge level provided.
- Regulatory frameworks shape scope and handling: PCI DSS governs cardholder data, HIPAA governs protected health information, and GDPR governs EU personal data.
- Cloud and third-party hosting requires confirming each provider's testing policy; providers still prohibit certain test types (e.g., DoS and DNS-zone-walking) even where pre-authorization is not required.
- Common standards and methodologies include PTES, OSSTMM, NIST SP 800-115, the OWASP testing guides (WSTG/MASVS), and the MITRE ATT&CK framework for aligning tests to realistic adversaries.
- Communication triggers require pausing and notifying the client: discovery of a prior or active breach, evidence of criminal activity, or a critical finding that needs out-of-band disclosure before the report.
- Deconfliction, de-escalation, situational awareness, and goal reprioritization keep the engagement aligned with the client and blue team as conditions change during testing.
- A complete report contains an executive summary (business risk, non-technical) for leadership and detailed technical findings with reproduction steps, evidence, and CVSS rationale for engineers.
- Findings are prioritized by risk so the client fixes the highest-impact issues first; identical findings across many hosts are deduplicated and mapped to a common root cause while preserving evidence.
- For systemic issues, recommend the design-level fix (segmentation, secure baseline) plus interim compensating controls, and document the full attack path so the client understands real-world impact.
- A retest/closure step with stable finding identifiers and a per-finding status field confirms remediation, and a formal close-out/readout meeting aligns stakeholders on fixes and priorities.
- Reports are a roadmap of exploitable weaknesses, so they must be encrypted at rest and in transit, delivered over a secure channel, and governed by a defined retention/destruction policy.
Domain 2: Reconnaissance and Enumeration
- Passive reconnaissance collects data without touching the target: WHOIS, DNS records, certificate transparency logs, job postings, and social media (OSINT); it generates no target traffic.
- Active reconnaissance sends packets directly to targets (port scans, banner grabbing) and creates entries in the target's firewall and IDS/IPS logs.
- Nmap -sS performs a stealthy SYN (half-open) scan; -sT is a full TCP connect scan; -sU scans UDP; -sn does host discovery (ping sweep) with no port scan.
- Nmap -sV detects service and version; -O enables OS detection; -sC runs the default NSE script category; -A combines OS detection, version detection, scripts, and traceroute.
- Nmap timing templates range -T0 (paranoid) to -T5 (insane); -T3 is the default and -T4 a common faster choice; masscan --rate caps packet rate for very large sweeps.
- Nmap -Pn treats all hosts as online (skips host discovery), useful when ICMP is blocked; -p specifies ports, e.g., nmap -p 80,443,8080 target.
- A DNS zone transfer is attempted with dig axfr example.com @ns1.example.com; misconfigured name servers leak the full record set.
- Enumeration extracts specifics: SMB shares (enum4linux, smbclient, rpcclient), SNMP (snmpwalk, default community string 'public'), LDAP/AD users (ldapsearch), and SMTP VRFY/EXPN.
- OSINT tools include theHarvester (emails/subdomains), Shodan and Censys (internet-exposed devices), Maltego (link analysis), and recon-ng; Google dorking finds exposed files.
- Web content and directory enumeration uses gobuster, ffuf, or feroxbuster to brute-force paths and virtual hosts, exposing hidden endpoints and admin panels.
- Misconfigured cloud storage (public S3 buckets, Azure blobs, GCS) frequently exposes sensitive data and is a high-value passive/active recon target; cloud_enum aids discovery.
- Large environments are scanned efficiently by grouping assets into scoped batches by subnet/role, reusing a maintained asset inventory to target only deltas, and placing distributed scan engines near each segment.
- Recon evasion techniques include Nmap decoy scans (-D), packet fragmentation (-f), idle/zombie scans, source-port spoofing, and slow timing to stay under detection thresholds.
Domain 3: Vulnerability Discovery and Analysis
- Scanner findings must be manually validated because automated tools report false positives; testers confirm exploitability before listing a result as a confirmed vulnerability.
- Common scanners include Nessus, OpenVAS/Greenbone, Qualys, Nexpose, and Nikto/wpscan (web); they rely on version comparisons and banner analysis and therefore need validation.
- Authenticated (credentialed) scanning logs into targets to reduce false positives and see installed patches and configuration, whereas unauthenticated scans see only what is externally exposed.
- CVSS v3.1 scores vulnerabilities 0.0-10.0 using attack vector, complexity, privileges required, user interaction, scope, and CIA impact; a vector string encodes each metric (e.g., AV:N/AC:L/PR:N/UI:N).
- Prioritization combines CVSS severity with real exploitability and business context: risk = likelihood x impact, and EPSS or known-exploited status raises urgency above raw score.
- Research and exploit mapping use CVE/CWE/NVD entries plus searchsploit, Exploit-DB, and Metasploit search to determine whether a public exploit exists for a finding.
- Scan tuning avoids outages: throttle rate, schedule scan windows, and exclude fragile hosts (legacy/ICS/OT) that aggressive scanning can crash, causing an unintended denial of service.
- Common finding classes include misconfigurations, default or weak credentials, end-of-life/unsupported software, missing patches, and weak TLS/SSL ciphers and protocols.
- SCAP and compliance scans (PCI, CIS Benchmarks) measure configuration against a defined baseline rather than only searching for exploitable CVEs.
- Attack-surface analysis maps the discovered footprint - exposed services, ports, and entry points - to focus deeper testing where impact is highest.
- Threat modeling methodologies (STRIDE, DREAD, PASTA, attack trees) and MITRE ATT&CK mapping structure how discovered weaknesses could be chained by a realistic adversary.
- Supply-chain and third-party component risk is assessed with dependency scanning and SBOM review, since a single vulnerable library can affect many applications.
- Correlating multiple scanner outputs and distinguishing true positives from false positives with a manual proof-of-concept keeps the final finding set accurate and actionable.
Domain 4: Attacks and Exploits
- Intercepting proxies such as Burp Suite and OWASP ZAP sit between the browser and the app to capture, modify, and replay HTTP/HTTPS requests for injection and logic testing.
- SQL injection inserts SQL syntax into unsanitized input (e.g., OR '1'='1', UNION SELECT); the primary defense is parameterized queries/prepared statements; sqlmap automates exploitation.
- Cross-site scripting (XSS) injects attacker JavaScript that runs in victims' browsers; types are stored, reflected, and DOM-based; defenses include output encoding and Content Security Policy.
- Server-side request forgery (SSRF) coerces a server into making attacker-controlled requests, often used to reach cloud metadata endpoints (169.254.169.254) for credentials.
- Password attacks include dictionary, brute force, hybrid, and password spraying (one common password tried slowly across many accounts to avoid lockout); spraying evades lockout thresholds.
- Offline cracking uses GPU acceleration with targeted wordlists, rule sets, and mask attacks (Hashcat, John the Ripper) before resorting to raw brute force.
- LLMNR/NBT-NS poisoning with Responder captures NTLM hashes on a LAN; SMB relay (ntlmrelayx) forwards captured authentication to other hosts that lack SMB signing.
- Kerberoasting requests service tickets (TGS) for accounts with SPNs and cracks them offline; AS-REP roasting targets accounts with Kerberos pre-authentication disabled.
- Social engineering vectors include phishing, spear phishing, pretexting/impersonation, vishing, smishing, and physical tactics like tailgating; SET and GoPhish assist campaigns.
- On-path (man-in-the-middle) attacks include ARP spoofing/poisoning, evil twin / rogue access points, and DNS spoofing, threatening confidentiality and integrity of traffic.
- Metasploit Framework provides exploit modules, payloads (e.g., windows/meterpreter/reverse_https), and post modules; msfvenom generates and encodes standalone payloads.
- Wireless attacks include capturing WPA2 4-way handshakes (or PMKID) for offline cracking, deauthentication attacks, and exploiting WPS PINs.
- Cloud, container, and API attacks include abusing instance metadata for IAM credentials, IAM privilege escalation, container/Kubernetes escapes, and API flaws such as BOLA and mass assignment.
Domain 5: Post-exploitation and Lateral Movement
- Privilege escalation elevates access beyond what was initially granted: on Linux via permissive sudo rules and SUID root binaries (see GTFOBins), on Windows via weak service permissions, unquoted service paths, and kernel exploits (e.g., PrintNightmare).
- Lateral movement pivots from a foothold to additional systems using Pass-the-Hash, Pass-the-Ticket, SMB relay, and remote execution via PsExec, WMI (wmic /node:target process call create), or PowerShell remoting.
- Pass-the-Hash reuses a captured NTLM hash to authenticate without the plaintext password; Impacket's psexec.py and wmiexec.py both accept the -hashes syntax.
- Mimikatz dumps plaintext passwords and NTLM hashes from LSASS memory (sekurlsa::logonpasswords); DCSync (Mimikatz or Impacket secretsdump.py) replicates credentials from a domain controller.
- BloodHound with the SharpHound collector maps Active Directory attack paths, revealing the shortest route to Domain Admin and abusable ACLs.
- Persistence mechanisms that survive reboot/credential change include new services, scheduled tasks running a stored PowerShell one-liner, Run registry keys, and adding a Linux user with UID 0; authorized testers must document and later remove all of them.
- Living-off-the-land binaries (LOLBins) such as certutil, bitsadmin, and rundll32, plus native tools, help evade detection by avoiding dropped malware.
- Pivoting reaches segmented networks via SSH port forwarding, a SOCKS proxy over an SSH/Meterpreter tunnel that many tools can reuse, or tools like Chisel and Ligolo-ng.
- Token impersonation/kidnapping (e.g., Potato family exploits) and abusing SeImpersonate privileges can elevate a service account to SYSTEM.
- Data exfiltration during testing should be demonstrated with stealthy channels such as encrypted chunked HTTPS transfers and DNS tunneling, exfiltrating only proof-of-concept data.
- Cleanup obligations require removing uploaded tools and backdoors, deleting created accounts, reverting configuration changes, and restoring systems to their original state.
- Comprehensive, timestamped documentation of every action (logs, screenshots) supports an accurate, reproducible report and provides accountability for what was done within scope.
- Windows privilege-escalation gotchas include writable PATH entries letting an attacker plant a malicious C:\Program.exe, and creating a malicious MSI executed via AlwaysInstallElevated to gain SYSTEM.
- Common credential locations include LSASS memory, the SAM/SYSTEM registry hives, ntds.dit on a domain controller, and Linux /etc/shadow; /proc/<pid>/environ can leak secrets passed as environment variables.
CompTIA PenTest+ (PT0-003) exam tips
- Watch for the 'first/most important step' qualifier in engagement questions - the answer is almost always obtaining written authorization and a signed scope/RoE before any other action.
- Memorize Nmap flags cold: -sS, -sT, -sU, -sn, -sV, -O, -sC, -A, -Pn, -p, and the -T0 to -T5 timing templates; performance-based questions often ask you to build or interpret a command.
- Separate reconnaissance/enumeration (discovering hosts, services, and info) from vulnerability discovery/analysis (scanning for and validating weaknesses) - PT0-003 treats them as distinct domains.
- Map each attack to its category and tool (e.g., Responder for LLMNR poisoning, Hashcat for offline cracking, Burp/ZAP for web, BloodHound for AD paths) so terminology questions are quick wins.
- When two answers both look correct, pick the one that is safest, legal, and consistent with the rules of engagement - notifying the client and stopping usually beats continuing.
Study guide FAQ
What is the difference between PenTest+ PT0-002 and the current PT0-003 exam?
PT0-003 is the current version (PT0-002 retired) and reorganizes the objectives into five domains - Engagement Management, Reconnaissance and Enumeration, Vulnerability Discovery and Analysis, Attacks and Exploits, and Post-exploitation and Lateral Movement. It increases emphasis on hands-on attack execution, modern environments (cloud, containers, APIs, and AI/ML systems), and scripting/automation. Always study against PT0-003 objectives.
How is the exam scored and what do I need to pass?
PenTest+ uses a scaled score from 100 to 900, and you need 750 to pass. The 165-minute exam includes up to 90 questions mixing multiple-choice and performance-based (hands-on simulation) items. Performance-based questions are weighted heavily, so practice building commands and analyzing tool output.
Do I need to memorize exact tool syntax and commands?
Yes. Performance-based questions can require you to construct or interpret real commands - Nmap scans, Hashcat cracking, Metasploit/msfvenom payloads, Impacket (psexec.py/wmiexec.py) for Pass-the-Hash, and dig for zone transfers. Know the common flags, default ports, and which tool solves which problem.
How much experience should I have before taking PenTest+?
CompTIA recommends 3-4 years of hands-on information security or penetration testing experience and a Network+/Security+ level of foundational knowledge. It is an intermediate certification, so prior comfort with networking, the command line, and basic scripting (Bash, Python, PowerShell) is expected.