CompTIA PenTest+ Training

This course prepares you for the PT0-003 certification exam, covering all official exam domains and their approximate weightings:

Domain 1 Engagement Management (13%)

• Summarize pre-engagement activities: scope definition, rules of engagement, agreement types (NDA, MSA, SOW, ToS), target selection, shared responsibility model, legal/ethical considerations
• Explain collaboration and communication activities: peer review, stakeholder alignment, escalation path, goal reprioritization, business impact analysis
• Compare and contrast testing frameworks and methodologies (OSSTMM, CREST, PTES, MITRE ATT&CK, OWASP Top 10/MASVS, threat modeling frameworks DREAD/STRIDE/OCTAVE)
• Explain the components of a penetration test report: executive summary, methodology, detailed findings, attack narrative, recommendations/remediation guidance
• Given a scenario, analyze findings and recommend appropriate remediation (technical, administrative, operational, physical controls)

Domain 2 Reconnaissance and Enumeration (21%)

• Given a scenario, apply information gathering techniques: active/passive reconnaissance, OSINT, DNS lookups, certificate transparency logs, network sniffing, protocol scanning
• Given a scenario, apply enumeration techniques: OS fingerprinting, service/protocol/DNS/directory/host/share/user/email enumeration, attack path mapping
• Given a scenario, modify scripts for reconnaissance and enumeration using Bash, Python, or PowerShell
• Given a scenario, use appropriate tools for reconnaissance and enumeration (Nmap, theHarvester, Shodan, Maltego, Recon-ng, Amass, WHOIS, Wireshark/tcpdump)

Domain 3 Vulnerability Discovery and Analysis (17%)

• Given a scenario, conduct vulnerability discovery using various techniques: container/application/network scans, DAST/IAST/SAST/SCA, authenticated vs. unauthenticated scans, wireless scanning, ICS vulnerability assessment
• Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases: validating results (false positives/negatives, true positives), public exploit selection, scripting to validate results
• Explain physical security concepts: tailgating, site surveys, USB drops, badge cloning, lock picking

Domain 4 Attacks and Exploits (35%)

• Given a scenario, analyze output to prioritize and prepare attacks: target prioritization (CVSS, CVE, CWE, EPSS), capability/tool/exploit selection, attack path and documentation
• Given a scenario, perform network, authentication, and host-based attacks using appropriate tools (Metasploit, Hydra, Mimikatz, CrackMapExec, Impacket, hashcat)
• Given a scenario, perform web application attacks (SQLi, XSS, SSRF, CSRF, file inclusion, JWT manipulation) using tools such as Burp Suite, ZAP, sqlmap, Gobuster
• Given a scenario, perform cloud-based and wireless attacks using appropriate tools (Pacu, ScoutSuite, Prowler, Aircrack-ng, Kismet)
• Given a scenario, perform social engineering attacks (phishing, vishing, pretexting) and explain attacks against specialized systems (mobile, AI/prompt injection, OT/ICS, NFC/Bluetooth)
• Given a scenario, use scripting (PowerShell, Bash, Python) and breach-and-attack simulation tools to automate attacks

Domain 5 Post-exploitation and Lateral Movement (14%)

• Given a scenario, perform tasks to establish and maintain persistence: scheduled tasks, service creation, reverse/bind shells, backdoors, C2 frameworks, rootkits
• Given a scenario, perform tasks to move laterally throughout the environment: pivoting, relay creation, service/credential enumeration, WMI/WinRM, LOLBins, tools like CrackMapExec, Impacket, PsExec
• Summarize concepts related to staging and exfiltration: file encryption/compression, covert channels (DNS, ICMP, HTTPS, steganography), cloud storage, alternate data streams
• Explain cleanup and restoration activities: removing persistence mechanisms and tester-created credentials/tools, reverting configuration changes, secure data destruction