CompTIA PenTest+ (PT0-003) Full Course & Practice Exam

Explore a comprehensive pentesting overview from planning and scope to reporting, emphasizing ethical, authorized practice while detailing information gathering, attacks, post-exploitation, and remediation recommendations.

Plan a penetration testing engagement by defining scope, complying with legal requirements, and establishing ROE, NDA, and SOW, while setting communication channels, risk tolerance, and authorization to attack.

Conduct passive and active information gathering to map a target, using OSINT, WHOIS, DNS, and scans with Nmap, Maltego, and Shodan to plan discreet attack strategies.

Focus on exploiting high-value vulnerabilities to gain initial access, using metasploit, sqlmap, and phishing techniques, while documenting methods, results, and evidence for reporting and remediation.

Execute post-exploitation by establishing persistence, escalating privileges, and moving laterally through the network, using pivoting and stealth exfiltration to achieve objectives, then clean up traces.

Learn the reporting phase of a penetration test: craft executive summaries for non-technical stakeholders, document methodology, findings, evidence, cvss-based risk ratings, and actionable remediation with an attack narrative.

Master a practical penetration testing workflow by performing scanning, vulnerability assessment, and exploitation on a vulnerable TryHackMe VM using Kali Linux, Nmap, and Metasploit to explore EternalBlue and MS17-010.

Understand pre-engagement activities that lay the foundation for a compliant penetration test, including stakeholder alignment, scope, governance, and agreements such as NDAs, MSAs, and SOWs across networks, cloud, and APIs.

Navigate regulations and standards guiding penetration testing, including HIPAA, GDPR, GLBA, PCI DSS, and ISO/IEC 27000 series, while ensuring stakeholder alignment and secure handling of data.

Explore network, wireless, web, mobile, application, cloud, and API assessments to identify vulnerabilities, strengthen security controls, and guide compliance across organizational technology infrastructure.

Examine ndas, msas, sows, and tos that govern client and pentest engagements, clarifying rights, responsibilities, and confidentiality.

Discuss legal and ethical considerations in penetration testing, including authorization letters with scope and reporting requirements, professional risk, and the escalation path to manage incidents.

Explore the rules of engagement for a pentest, detailing exclusions, test cases, testing windows, goal reprioritization, and business impact analysis within the statement of work.

Define the test scope by selecting CIDR ranges, domains, IP addresses, and URLs across external and internal assets, determining the engagement's scope and potential success.

Explore the shared responsibility model in cloud security, detailing roles for cloud providers, customers, third party vendors, and penetration testers, and how coordination ensures secure cloud environments.

Prepare for a cloud-based penetration test by reviewing AWS's allowed services, scope, and authorization, including EC2, RDS, CloudFront, and Aurora, and complete the simulated events submission form with emergency contacts.

Explore pentest frameworks like Mitre Attack, OWASP, MASVS, PTES, CREST, OSSTMM, and STRIDE to compare and contrast testing frameworks and methodologies for real-world engagements.

Explore how the MITRE ATT&CK framework catalogs adversary tactics and techniques in matrices to guide threat modeling, testing, and defending against spear phishing.

Explore the Open Web Application Security Project (OWASP) and its top 10 risks, focusing on broken access control, cryptographic failures, and injection to guide web security assessments.

OWASP MASVS establishes a baseline security for mobile apps by organizing eight control groups, such as MASVS-STORAGE and MASVS-PRIVACY, with MASTG and MAS Checklist for validation and compliance.

Explore the penetration testing execution standard (ptes), a seven-phase framework guiding penetration tests from pre-engagement through reporting, with both programmatic planning and tactical execution.

Explore CREST Defensible Penetration Test guidelines, ensuring tests are scoped, executed, and reported by accredited organizations and qualified testers.

Explore the OSSTMM, a peer‑reviewed, open methodology for objective, evidence‑based security testing across digital, human, physical, and wireless environments, with certifications like OPSA and OPST.

Explore the STRIDE threat modeling framework and its six categories: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, to safeguard confidentiality, integrity, and availability.

Learn how the Purdue Model for industrial control system security segments OT networks into six levels, from physical process to enterprise, to isolate assets and guide pentest assessments.

Explore the OCTAVE threat-modeling framework, a self-directed, risk-based method linking assets, threats, and vulnerabilities to organizational risk, with three phases and eight processes.

Explain the DREAD risk assessment model, scoring each category from 0 to 10—damage potential, reproducibility, exploitability, affected users, and discoverability—to prioritize security threats from low to critical.

Explore the MITRE ATT&CK framework to understand enterprise techniques like active scanning, content injection, and access token manipulation, with real-world examples and actionable detection and mitigation strategies.

Learn information gathering for penetration testing, including passive and active reconnaissance, OSINT, network sniffing, port scanning, HTML scraping, cached pages, and banner grabbing to map targets and plan defenses.

Identify how passive reconnaissance gathers target information without direct interaction, using social media, job boards, public code repositories, and password dumps to map tech stacks and vulnerabilities.

Explore network sniffing as a key phase of network reconnaissance, capturing and analyzing PCAP data with tcpdump and Wireshark to reveal vulnerabilities in IoT and OT protocols.

Explore active reconnaissance in penetration testing, covering port and protocol scanning, banner grabbing, and DNS interaction with dig to map open ports and weaknesses.

Explore port and protocol scanning for network reconnaissance and pentesting, comparing tcp and udp behaviors, syn scans and icmp clues, and how nmap reveals open ports and application-layer services.

Explore HTML scraping, cached pages, and reverse image searches to uncover hidden details, outdated endpoints, and potential vulnerabilities in target sites.

Master banner grabbing as an information-gathering technique to identify service type, version, and configurations using wget, curl, netcat, and nmap, revealing vulnerabilities and misconfigurations.

Learn how banner grabbing exposes web server details and version information using curl, wget, Nmap, and netcat to enable vulnerability research in early penetration testing.

Explore open-source intelligence (OSINT) to collect public data for reconnaissance and enumeration, revealing attack vectors through social media, disclosures, social engineering, cryptographic flaws, DNS lookups, and certificate transparency.

Explore how social media and job boards inform footprinting and reconnaissance in penetration testing, revealing organizational structure, technologies, and vulnerabilities to guide social engineering and technical testing.

Analyze information disclosure in OSINT, showing how misconfigured servers, insecure storage, faulty code, and error handling expose data. Leverage Google dorking, Shodan, and Censys to identify assets and improve security.

Identify cryptographic flaws from weak algorithms like MD5, SHA-1, and RC4 and assess certificate misconfigurations, expirations, and weak signatures using OpenSSL and certificate transparency tools.

Learn how DNS lookups and reverse lookups map host names to IP addresses using tools like dig and nslookup, and review records A, AAAA, CNAME, MX, PTR, osint, and attacks.

Explore certificate transparency logs and how they secure web PKI, enabling pentesters to detect rogue certificates, map infrastructure, and assess renewal hygiene using crt.sh and Let's Encrypt data.

Explore search engine analysis and enumeration for open-source intelligence, using operators, site and filetype filters, and Google Alerts for ongoing monitoring to uncover exposed content and infrastructure.

Conduct open-source intelligence by analyzing social media and company profiles, especially LinkedIn, to uncover employee details, roles, and behind the scenes data, informing threat modeling and recon for pentest engagements.

Move from reconnaissance to active probing with scanning and enumeration to uncover OS and service details, protocols, DNS, directories, hosts, users, emails, permissions, wireless devices, secrets, and web vulnerabilities.

Use Zenmap and Nmap for OS and service discovery on a local network, from ping scans to intense enumeration, identifying hosts, open ports, OS, and firewall insights.

Enumerate network, transport, application, and remote access protocols to reveal live hosts, firewall rules, and service weaknesses, and to craft attack strategies using tools like Nmap, ping sweeps, and snmpwalk.

Explore external DNS enumeration techniques to map a target's network with nslookup and dig, perform zone transfers, query records (A, MX, NS, TXT), and reveal subdomains with brute force tools.

Enumerate directories and files using automated tools and custom wordlists, analyze robots.txt and error responses, and extend to URL fuzzing, server-side include injection, and network service enumeration.

Enumerate hosts by mapping the network, discovering live systems, scanning ports and services, fingerprinting operating systems, performing credentialed scans, and enumerating Windows Active Directory with PowerShell.

Identify local user accounts on Windows and Linux, examine group memberships, and assess privileges with Get-LocalUser, net user, and /etc/passwd and /etc/shadow. Highlight implications for credential harvesting and privilege escalation.

Enumerating email addresses within a target organization reveals its structure. Learn SMTP-based enumeration using VRFY and EXPN, OSINT via theHarvester and LinkedIn, and validation with Hunter.io to enable phishing simulations.

Enumerate permissions across file systems, databases, network shares, Active Directory, and cloud environments to reveal misconfigurations and potential privilege escalation. Learn PowerView, getfacl, ls, sqlmap, AWS CLI, and Azure PowerShell.

Enumerate wireless devices to identify vulnerabilities by scanning access points and evaluating configurations. Learn wardriving, war walking, and using WiGLE and tools like Kismet, Aircrack-ng, and Wifite.

Enumerate secrets by identifying passwords, session tokens, cloud access keys, and API keys. Explore techniques like brute forcing, password spraying, credential stuffing, and session hijacking with Burp Suite and Pacu.

Master web enumeration techniques, from DirBuster crawling to manual enumeration, robots.txt and sitemap analysis, plugin checks, and WAF considerations.

Map attack paths to reveal how attackers move through a network, escalate privileges, and reach sensitive assets, starting with reconnaissance and using BloodHound and MITRE ATT&CK for actionable insights.

Explore reconnaissance and enumeration tools to gather target information, including Wayback Machine, OSINT frameworks, whois, DNS tools, Shodan, Censys.io, and wireless and packet capture techniques.

Explore the Wayback Machine as an OSINT tool for reconnaissance, revealing historical snapshots, directories, subdomains, and outdated software to map an organization’s digital footprint.

Explore theHarvester and Hunter.io to gather OSINT on emails, subdomains, and organizational structures during reconnaissance, enabling targeted spear phishing campaigns and awareness testing.

Explore reconnaissance and enumeration using OSINT Framework, Maltego, and SpiderFoot to map domains, IP addresses, emails, and social connections for targeted penetration testing.

Use Recon-ng to create a workspace, insert a domain, run a DNS brute-force module, and view discovered subdomains; then use Whois to retrieve domain registration metadata.

Learn to gather DNS information with nslookup and dig through DNS enumeration, identifying A and MX records, mail servers, and authoritative versus non-authoritative responses.

Use DNSdumpster and Amass to map a target's external attack surface through passive and active reconnaissance. Discover subdomains, IPs, DNS records, and misconfigurations to guide vulnerability assessment.

Map the external attack surface with Shodan and Censys.io to uncover internet-connected devices, services, and configurations for scalable reconnaissance and identifying misconfigurations and outdated software.

Use tcpdump, a lightweight command-line packet-capture tool, to capture and view traffic on a network interface, gaining visibility for reconnaissance, exploitation, and testing.

Harness Wireshark for reconnaissance in penetration testing by capturing live traffic to reveal weaknesses, unencrypted credentials, misconfigurations, web vulnerabilities like SQL injection, telnet credentials, and DNS captures.

Master three core wireless analysis tools—Aircrack-ng, InSSIDer, and WiGLE—for wireless reconnaissance, handshake captures, signal mapping, and remote footprinting in penetration testing.

Master Nmap and the Nmap scripting engine (NSE) for reconnaissance and enumeration, performing discovery scans, port scans, and fingerprinting, and automating vulnerability checks with Lua scripts during authorized network testing.

Learn how Nmap discovery scans identify live hosts before port enumeration, using ARP probes (-PR) and IP-layer probes with -PS, -PE, -PA, -PU, plus timing controls to tailor scans.

Learn how Nmap port scans convert a vast 65,535 tcp and udp port space into a focused list of reachable services, using scan types, tactics, and port states.

Perform active fingerprinting to identify operating systems, services, and versions via Nmap -sV, -A, and -O; enhance with NSE scripts using --script and --script-args to prioritize testing.

Master practical nmap scanning in a Kali Linux lab: perform ping scans, syn scans, -sV and -O analyses across multiple targets, interpret results, and save outputs for vulnerability discovery.

Explore the Nmap scripting engine (NSE) to automate service enumeration, authentication testing, and vulnerability detection with Lua scripts, using script categories and CVE-linked results.

Learn scripting basics to automate reconnaissance and enumeration during penetration tests. Explore pseudocode, programming concepts, and translating designs into working code across languages.

Explore how scripts automate repetitive commands in penetration testing and compare Bash, PowerShell, WMIC, Python, Ruby, Perl, and JavaScript. Learn to read and interpret scripts for the PenTest+ exam.

Explore data types—booleans, integers, floats, characters, and strings—and their role in storage. Identify how variables change values and how constants stay fixed, with type conversions for math.

Learn how for, while, and do loops automate repetitive tasks in penetration testing, enabling deterministic iteration, dynamic conditions, and at least one initial action in scripting workflows.

Apply logic control in scripts to automate decision making in penetration testing, using boolean, arithmetic, and string tests, with else-if and boolean operators.

Explore seven key data structures—key-value pairs, JSON, arrays, lists, dictionaries, CSV, and trees—and learn to store, retrieve, and manipulate structured data for penetration testing.

Explore object-oriented programming and its four core code types—functions, procedures, classes, and libraries—showing how objects bundle data and methods for modular, reusable, and maintainable code.