CompTIA Pentest+

Plan and scope a penetration test, perform vulnerability assessment to identify and validate exploitable weaknesses, and document findings in a report guided by standards.

Define a pin tester and outline planning a pin test engagement, covering target audience, stakeholders, resources, budget, technical constraints, rules of engagement, impact analysis, and remediation timelines.

Define clear scope, boundaries, and the statement of work for a pentest, align stakeholders, select assessment type (gold, compliance, red team), identify targets, risks, and deliverables.

Plan and scope a penetration test by preparing the client and the test team, documenting data, and establishing escalation, backups, and go-live procedures to minimize impact.

Gather open source intelligence using public sources, websites, registries, social media, and job postings to reveal targets and inform pentest reconnaissance; utilize tools like whois and DNS to expand findings.

Identify, analyze, and weaponize open source intelligence from passive reconnaissance to guide targeted active reconnaissance, focusing on IPs, subdomains, people data, third-party sites, and technology insights.

Explore social engineering attacks, from phishing and impersonation to spear phishing and hoaxes, and learn non-technical security tests that probe vulnerabilities and physical access controls.

Perform physical security tests by identifying fences, locks, cameras, lighting, and motion sensors. Apply fence jumping, dumpster diving, RFID cloning, and motion-sensor bypass techniques.

Conduct network scanning to discover hosts, ports, and services, perform vulnerability scanning with nmap, and map subnets while analyzing OS fingerprints and routing tables.

This module covers active reconnaissance through enumeration to identify hosts, services, and credentials, using banner grabbing and tools like Nmap and RPC client.

Conduct active reconnaissance by performing vulnerability and compliance scans across host, server, web, apps, and network devices, using credentialed and non-credentialed methods, and assessing container and wireless risks.

Automate reconnaissance tasks with scripting to extend tool capabilities and customize workflows. Learn Bash, PowerShell, Python, and Ruby to build and use scripts for efficient, error-aware pentesting.

Analyze vulnerability scan results with asset classification, false positives validation, and CVSS-based adjudication to prioritize vulnerabilities and leverage gathered information for preparation for exploitation.

Map vulnerabilities to targets to guide planning and prioritize attack techniques. Explore exploits, payloads, deception tactics, and password attacks, including dictionary, rainbow table, brute force, and cross-compiled exploits.

Penetrate networks by examining sniffing, eavesdropping, ARP poisoning, and man-in-the-middle attacks, with SMB exploits, DNS cache poisoning, and VLAN hopping.

Analyze wireless and radio frequency vulnerabilities, including WEP weaknesses, WPA/WPA2 protections, and offline attacks like pixie dust. Explore replay, deauthentication, evil twin, sniffing, and bluejacking techniques on wireless networks.

Examine how attackers exploit specialized systems, including mobile devices, industrial control systems, embedded and rtos devices, IoT, and point-of-sale terminals, to access data, disrupt operations, and test defenses.

Explore host-based vulnerabilities in Windows, Unix, and Linux and learn common weakness patterns, memory exploits, and password-related attacks. Apply defensive context by examining default accounts, sandbox escapes, and responsible patching.

Explore Linux and Unix-like vulnerabilities, covering kernel, services, and password cracking, with focus on Linux filesystem permissions, sticky bits, setuid/setgid, and privilege escalation techniques.

Assess web applications by identifying misconfigurations, authentication and authorization flaws, and injections (sql, html, xss), plus csrf and file inclusion, using practical testing methods and tools.

Explore static and dynamic analysis techniques for testing source code and compiled apps, including sast/dast, fuzzing, and reverse engineering via decompilation, disassembly, and debugging.

Complete post-exploit tasks by extending impact through lateral movement, maintaining access with persistence, and using anti-forensic techniques to disrupt investigations, then pivot across subnets via port forwarding.

Explore persistence techniques to maintain footholds after a breach, including new user accounts, backdoors, remote access tools, shells, scheduled tasks, cron jobs, and services across Windows and Linux.

Explore anti forensics techniques to disrupt investigations and cover tracks after exploitation. Examine buffer overflow, memory residence, program packing, vm detection, alternate data streams, and log or timestamp manipulation.