CompTIA PenTest+ PT0-003 Preparation Details
This CompTIA PenTest+ PT0-003 study guide covers all five exam domains, from engagement management to post-exploitation and lateral movement. Each objective links to official documentation and standards so you can prepare with confidence. You can also explore more CompTIA certification study guides on the CompTIA category to keep building your skills.
CompTIA PenTest+ PT0-003 Materials
| Coursera | CompTIA PenTest+ (PT0-003) |
| Udemy | CompTIA PenTest+ (PT0-003) Full Course & Practice Exam |
| Whizlabs | CompTIA PenTest+ (PT0-003) Certification Training |
1.0 Engagement Management (13%)
1.1 Summarize pre-engagement activities.
Scope definition
Technical Guide to Information Security Testing and Assessment
PCI Data Security Standard (PCI DSS)
RFC 4632: Classless Inter-domain Routing (CIDR)
Shared responsibility model
Shared responsibility in the cloud
The NIST Definition of Cloud Computing
Legal and ethical considerations
9-48.000 – Computer Fraud and Abuse Act
Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
Technical Guide to Information Security Testing and Assessment
1.2 Explain collaboration and communication activities.
Peer review
Technical Guide to Information Security Testing and Assessment
Implementation & Procurement Guides
Stakeholder alignment
Technical Guide to Information Security Testing and Assessment
The Penetration Testing Execution Standard
Implementation & Procurement Guides
Guide for Conducting Risk Assessments
Root cause analysis
Incident Response Recommendations and Considerations
Guide for Conducting Risk Assessments
Technical Guide to Information Security Testing and Assessment
Escalation path
Incident Response Recommendations and Considerations
Contingency Planning Guide for Federal Information Systems
Technical Guide to Information Security Testing and Assessment
Secure distribution
Traffic Light Protocol (TLP) Definitions and Usage
Security and Privacy Controls for Information Systems and Organizations
Articulation of risk, severity, and impact
Common Vulnerability Scoring System Version 4.0
Guide for Conducting Risk Assessments
Goal reprioritization
Technical Guide to Information Security Testing and Assessment
Incident Response Recommendations and Considerations
Business impact analysis
Contingency Planning Guide for Federal Information Systems
Guide for Conducting Risk Assessments
Client acceptance
Technical Guide to Information Security Testing and Assessment
Implementation & Procurement Guides
1.3 Compare and contrast testing frameworks and methodologies.
Open Source Security Testing Methodology Manual (OSSTMM)
ISECOM — Institute for Security and Open Methodologies
Council of Registered Ethical Security Testers (CREST)
Cyber Security Services, Accreditations & Training
Implementation & Procurement Guides
Penetration Testing Execution Standard (PTES)
The Penetration Testing Execution Standard
MITRE ATT&CK
Open Web Application Security Project (OWASP) Top 10
OWASP Mobile Application Security Verification Standard (MASVS)
Purdue model
Guide to Operational Technology (OT) Security
Security and Privacy Controls for Information Systems and Organizations
Threat modeling frameworks
Threats – Microsoft Threat Modeling Tool – Azure
Microsoft Threat Modeling Tool overview – Azure
Threat Modeling Process (Historical)
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment
1.4 Explain the components of a penetration test report.
Format alignment
Technical Guide to Information Security Testing and Assessment
Implementation & Procurement Guides
Documentation specifications
Technical Guide to Information Security Testing and Assessment
Risk scoring
Common Vulnerability Scoring System Version 4.0
Guide for Conducting Risk Assessments
Definitions
Technical Guide to Information Security Testing and Assessment
Common Vulnerability Scoring System Version 4.0
Report components
Technical Guide to Information Security Testing and Assessment
Implementation & Procurement Guides
Test limitations and assumptions
Technical Guide to Information Security Testing and Assessment
Guide for Conducting Risk Assessments
Reporting considerations
Technical Guide to Information Security Testing and Assessment
Generative Artificial Intelligence Profile
Implementation & Procurement Guides
Common Vulnerability Scoring System Version 4.0
1.5 Given a scenario, analyze the findings and recommend the appropriate remediation within a report.
Technical controls
Guide to General Server Security
SQL Injection Prevention Cheat Sheet
Multifactor Authentication Cheat Sheet
Guide to Enterprise Patch Management Planning
Recommendation for Key Management: Part 1 – General
Secrets Management Cheat Sheet
Network segmentation Cheat Sheet
Administrative controls
Role Based Access Control RBAC
Secure Software Development Framework (SSDF) Version 1.1
Security and Privacy Controls for Information Systems and Organizations
An Introduction to Information Security
Operational controls
Security and Privacy Controls for Information Systems and Organizations
Building a Cybersecurity and Privacy Learning Program
An Introduction to Information Security
Physical controls
Guidelines for the Use of PIV Credentials in Facility Access
Biometric Specifications for Personal Identity Verification
Security and Privacy Controls for Information Systems and Organizations
2.0 Reconnaissance and Enumeration (21%)
2.1 Given a scenario, apply information gathering techniques.
Active and passive reconnaissance
Search Open Technical Databases
Technical Guide to Information Security Testing and Assessment
Nmap Overview and Demonstration
Open-source intelligence (OSINT)
Search Open Websites/Domains: Social Media
Search Open Websites/Domains: Code Repositories
Search Open Technical Databases: DNS/Passive DNS
CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Network reconnaissance
Gather Victim Network Information
Active Scanning: Scanning IP Blocks
Search Open Technical Databases: Scan Databases
Protocol scanning
RFC 9293: Transmission Control Protocol (TCP)
RFC 768: User Datagram Protocol
Chapter 18. Nping Reference Guide
Certificate transparency logs
Working together to detect maliciously or mistakenly issued certificates.
How CT fits into the wider Web PKI ecosystem
RFC 9162: Certificate Transparency Version 2.0
Search Open Technical Databases: Digital Certificates
Information disclosure
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-538: Insertion of Sensitive Information into Externally-Accessible File
CWE-615: Inclusion of Sensitive Information in Source Code Comments
Review Webserver Metafiles for Information Leakage
Review Web Page Content for Information Leakage
Review Old Backup and Unreferenced Files for Sensitive Information
Search engine analysis/enumeration
Conduct Search Engine Reconnaissance for Information Leakage
Search Open Websites/Domains: Search Engines
Network sniffing
Guide to Operational Technology (OT) Security
CWE-319: Cleartext Transmission of Sensitive Information
Banner grabbing
Hypertext Markup Language (HTML) scraping
Review Web Page Content for Information Leakage
2.2 Given a scenario, apply enumeration techniques.
Operating system (OS) fingerprinting
Chapter 8. Remote OS Detection
Gather Victim Host Information
Service discovery
Chapter 7. Service and Application Version Detection
Chapter 9. Nmap Scripting Engine
Protocol enumeration
Chapter 9. Nmap Scripting Engine
RFC 5321: Simple Mail Transfer Protocol
DNS enumeration
RFC 1035: Domain names – implementation and specification
RFC 5936: DNS Zone Transfer Protocol (AXFR)
Directory enumeration
CWE-548: Exposure of Information Through Directory Listing
Review Old Backup and Unreferenced Files for Sensitive Information
Enumerate Infrastructure and Application Admin Interfaces
Host discovery
Chapter 3. Host Discovery (“Ping Scanning”)
Chapter 18. Nping Reference Guide
Active Scanning: Scanning IP Blocks
Share enumeration
Local user enumeration
Account Discovery: Local Account
Email account enumeration
Account Discovery: Email Account
RFC 5321: Simple Mail Transfer Protocol
CWE-204: Observable Response Discrepancy
Account Enumeration and Guessable User Account
Wireless enumeration
Kismet: Wi-Fi, Bluetooth, RF, and more
Guidelines for Securing Wireless Local Area Networks (WLANs)
Permission enumeration
IAM policy testing with the IAM policy simulator
Restrict guest user access permissions – Microsoft Entra ID
Secrets enumeration
Manage access keys for IAM users
Secrets Management Cheat Sheet
Session Management Cheat Sheet
Steal Application Access Token
Attack path mapping
Cloud Infrastructure Discovery
Map Execution Paths Through Application
Web application firewall (WAF) enumeration
Search Open Technical Databases: Scan Databases
Search Open Technical Databases: Digital Certificates
Web crawling
Identify Application Entry Points
Manual enumeration
RFC 9309: Robots Exclusion Protocol
Review Webserver Metafiles for Information Leakage
Fingerprint Web Application Framework
2.3 Given a scenario, modify scripts for reconnaissance and enumeration.
Information gathering
Technical Guide to Information Security Testing and Assessment
Chapter 15. Nmap Reference Guide
urllib.request — Extensible library for opening URLs
socket — Low-level networking interface
Data manipulation
re — Regular expression operations
json — JSON encoder and decoder
Scripting languages
Logic constructs
Use of libraries, functions, and classes
2.4 Given a scenario, use the appropriate tools for reconnaissance and enumeration.
Wayback Machine
Wayback Machine General Information
Maltego
Glossary for Maltego Graph (Desktop)
Recon-ng
recon-ng-marketplace: Official module repository for the Recon-ng Framework.
Shodan
SpiderFoot
smicallef/spiderfoot: SpiderFoot automates OSINT for threat intelligence
WHOIS
Registration Data Access Protocol (RDAP)
Registration Data Access Protocol (RDAP) Query Format
nslookup/dig
Domain names – concepts and facilities
Domain names – implementation and specification
Censys.io
Hunter.io
DNSdumpster
DNSDumpster – Find & lookup dns records for recon & research
Amass
Nmap
Chapter 15. Nmap Reference Guide
Chapter 9. Nmap Scripting Engine
theHarvester
WiGLE.net
WiGLE: Wireless Network Mapping
InSSIDer
inSSIDer Wi‑Fi Scanner by Oscium
Wi‑Fi Training Hub for Professionals
OSINTframework.com
Wireshark/tcpdump
Chapter 4. Capturing Live Network Data
Chapter 6. Working With Captured Packets
Aircrack-ng
Aircrack-ng – Main documentation
3.0 Vulnerability Discovery and Analysis (17%)
3.1 Given a scenario, conduct vulnerability discovery using various techniques.
Types of scans
Technical Guide to Information Security Testing and Assessment
Application Container Security Guide
OWASP DevSecOps Guideline – v-0.2
Infrastructure as Code Security
Industrial control systems (ICS) vulnerability assessment
Guide to Operational Technology (OT) Security
Cybersecurity Best Practices for Industrial Control Systems
Tools
Greenbone Community Documentation
trufflesecurity/trufflehog: Find, verify, and analyze leaked credentials
BloodHound Community Edition Quickstart
Welcome to Tenable Nessus 10.12.x
PowerSploit – A PowerShell Post-Exploitation Framework
Welcome to kube-hunter documentation
aquasecurity/kube-hunter: Hunt for security weaknesses in Kubernetes clusters
3.2 Given a scenario, analyze output from reconnaissance, scanning, and enumeration phases.
Validate scan, reconnaissance, and enumeration results
Technical Guide to Information Security Testing and Assessment
Tenable Nessus Troubleshooting
Public exploit selection
Exploit Database SearchSploit Manual
Known Exploited Vulnerabilities Catalog
Exploit Prediction Scoring System (EPSS)
Common Vulnerability Scoring System SIG
Use scripting to validate results
Chapter 9. Nmap Scripting Engine
socket — Low-level networking interface
subprocess — Subprocess management
3.3 Explain physical security concepts.
Tailgating
Avoiding Social Engineering and Phishing Attacks
Security and Privacy Controls for Information Systems and Organizations
Guidelines for the Use of PIV Credentials in Facility Access
Site surveys
Security Assessment at First Entry (SAFE) Fact Sheet
Physical Security Considerations for Temporary Facilities Fact Sheet
Guidelines for Securing Wireless Local Area Networks (WLANs)
Technical Guide to Information Security Testing and Assessment
Universal Serial Bus (USB) drops
Avoiding Social Engineering and Phishing Attacks
Security and Privacy Controls for Information Systems and Organizations
Insider Threat Mitigation Guide
Badge cloning
Personal Identity Verification (PIV) of Federal Employees and Contractors
Guidelines for the Use of PIV Credentials in Facility Access
Security and Privacy Controls for Information Systems and Organizations
Lock picking
Security and Privacy Controls for Information Systems and Organizations
Physical Security Considerations for Temporary Facilities Fact Sheet
4.0 Attacks and Exploits (35%)
4.1 Given a scenario, analyze output to prioritize and prepare attacks.
Target prioritization
Criticality Analysis Process Model: Prioritizing Systems and Components
CVSS v4.0 Specification Document
Exploit Prediction Scoring System (EPSS)
CWE-1188: Initialization of a Resource with an Insecure Default
Overview – Product End of Support and Retirements – Microsoft Lifecycle
Transitioning the Use of Cryptographic Algorithms and Key Lengths
Capability selection
Metasploit Documentation Penetration Testing Software, Pen Testing Security
Technical Guide to Information Security Testing and Assessment
Security Categorization of Federal Information and Information Systems
4.2 Given a scenario, perform network attacks using the appropriate tools.
Attack types
CWE-1392: Use of Default Credentials
Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay
Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS)
A05:2021 – Security Misconfiguration
Tools
Metasploit Documentation Penetration Testing Software, Pen Testing Security
Chapter 9. Nmap Scripting Engine
4.3 Given a scenario, perform authentication attacks using the appropriate tools.
Attack types
Multi-Factor Authentication Request Generation
Use Alternate Authentication Material: Pass the Hash
Use Alternate Authentication Material: Pass the Ticket
Use Alternate Authentication Material: Application Access Token
Steal or Forge Kerberos Tickets
LDAP Injection Prevention Cheat Sheet
Credential Stuffing Prevention Cheat Sheet
OpenID Connect Core 1.0 incorporating errata set 2
Tools
4.4 Given a scenario, perform host-based attacks using the appropriate tools.
Attack types
Microsoft Defender Antivirus in Windows Overview
Obfuscated Files or Information
CWE-639: Authorization Bypass Through User-Controlled Key
Process Injection: Dynamic-link Library Injection
Process Injection: Process Hollowing
Hijack Execution Flow: Path Interception by Unquoted Path
Tools
Introducing the Windows PowerShell ISE
4.5 Given a scenario, perform web application attacks using the appropriate tools.
Attack types
Vulnerabilities in password-based login
Server-side request forgery (SSRF)
Cross-site request forgery (CSRF)
Server-side template injection
Insecure direct object references (IDOR)
CWE-94: Improper Control of Generation of Code
CWE-98: Improper Control of Filename for Include/Require Statement in PHP
Server Software Component: Web Shell
Tools
Burp Suite documentation: desktop editions
4.6 Given a scenario, perform cloud-based attacks using the appropriate tools.
Attack types
Unsecured Credentials: Cloud Instance Metadata API
Security best practices in IAM
Blocking public access to your Amazon S3 storage
Tools
aquasecurity/kube-hunter: Hunt for security weaknesses in Kubernetes clusters
prowler-cloud/prowler: This repo hosts Prowler OSS (CLI and Local Server).
nccgroup/ScoutSuite: Multi-Cloud Security Auditing Tool
Introduction to AWS Security Hub CSPM
Microsoft Defender for Cloud Overview
4.7 Given a scenario, perform wireless attacks using the appropriate tools.
Attacks
Tools
P0cL4bs/wifipumpkin3: Powerful framework for rogue access point attack.
4.8 Given a scenario, perform social engineering attacks using the appropriate tools.
Attack types
Avoiding Social Engineering and Phishing Attacks
How to Recognize and Report Spam Text Messages
watering hole attack – Glossary
Tools
The Social-Engineer Toolkit (SET)
gophish/gophish: Open-Source Phishing Toolkit
laramies/theHarvester: E-mails, subdomains and names Harvester – OSINT
4.9 Explain common attacks against specialized systems.
Attack types
Adversarial Machine Learning: A Taxonomy and Terminology
SocketCAN – Controller Area Network
Tools
Welcome to Scapy’s documentation!
Mobile Security Framework (MobSF)
ReversecLabs/drozer: The Leading Security Assessment Framework for Android.
4.10 Given a scenario, use scripting to automate attacks.
PowerShell
Bash
Python
Welcome to Scapy’s documentation!
socket — Low-level networking interface
subprocess — Subprocess management
Breach and attack simulation (BAS)
apache/caldera: Automated Adversary Emulation Platform
Welcome to MITRE Caldera’s documentation!
Guardicore Infection Monkey Documentation
Home · redcanaryco/invoke-atomicredteam Wiki
5.0 Post-exploitation and Lateral Movement (14%)
5.1 Given a scenario, perform tasks to establish and maintain persistence.
Scheduled tasks/cron jobs
Scheduled Task/Job: Scheduled Task
crontab(5) — Linux manual page
Service creation
Create or Modify System Process: Windows Service
Create or Modify System Process: Systemd Service
systemd.service(5) — Linux manual page
Reverse shell
Chapter 17. Ncat Reference Guide
Command and Scripting Interpreter: Unix Shell
Non-Application Layer Protocol
Bind shell
Chapter 17. Ncat Reference Guide
Command and Scripting Interpreter: Unix Shell
Non-Application Layer Protocol
Add new accounts
Account Manipulation: SSH Authorized Keys
Obtain valid account credentials
Unsecured Credentials: Credentials In Files
Registry keys
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Command and control (C2) frameworks
Backdoor
Server Software Component: Web Shell
Compromise Host Software Binary
Supply Chain Compromise: Compromise Software Supply Chain
Rootkit
Hijack Execution Flow: Dynamic Linker Hijacking
Browser extensions
Tampering security controls
5.2 Given a scenario, perform tasks to move laterally throughout the environment.
Pivoting
sshuttle: where transparent proxy meets VPN meets ssh
ProxyChains-NG ver 4.17 README.
Relay creation
Enumeration
OS Credential Dumping: LSASS Memory
Unsecured Credentials: Credentials In Files
Service discovery
Remote Services: SMB/Windows Admin Shares
Remote Services: Remote Desktop Protocol
Lightweight Directory Access Protocol (LDAP): The Protocol
Window Management Instrumentation (WMI)
Windows Management Instrumentation
Windows Management Instrumentation
Remote Services: Distributed Component Object Model
Window Remote Management (WinRM)
Remote Services: Windows Remote Management
Tools
Living Off The Land Binaries, Scripts and Libraries
NetExec – The Network Execution Tool
5.3 Summarize concepts related to staging and exfiltration.
File encryption and compression
Archive Collected Data: Archive via Utility
Covert channel
Data Obfuscation: Steganography
Application Layer Protocol: DNS
DOMAIN NAMES – IMPLEMENTATION AND SPECIFICATION
INTERNET CONTROL MESSAGE PROTOCOL
Non-Application Layer Protocol
Exfiltration Over Alternative Protocol
Exfiltration Over Alternative Protocol
Cross-account resources
Transfer Data to Cloud Account
IAM tutorial: Delegate access across AWS accounts using IAM roles
Cloud storage
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Alternate data streams
Hide Artifacts: NTFS File Attributes
File Streams (Local File Systems)
Text storage sites
Exfiltration Over Web Service: Exfiltration to Text Storage Sites
Exfiltration Over Alternative Protocol
Virtual drive mounting
5.4 Explain cleanup and restoration activities.
Remove persistence mechanisms
Indicator Removal: File Deletion
Revert configuration changes
Technical Guide to Information Security Testing and Assessment
Remove tester-created credentials
Technical Guide to Information Security Testing and Assessment
Remove tools
Indicator Removal: File Deletion
Technical Guide to Information Security Testing and Assessment
Spin down infrastructure
Terminate Amazon EC2 instances
Delete Resource Groups and Resources
Technical Guide to Information Security Testing and Assessment
Preserve artifacts
Guide to Integrating Forensic Techniques into Incident Response
Guidelines for Evidence Collection and Archiving
Incident Response Recommendations and Considerations
Technical Guide to Information Security Testing and Assessment
Secure data destruction
NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization
Wrapping Up CompTIA PenTest+ PT0-003
This CompTIA PenTest+ PT0-003 study guide gives you every domain, task and objective in one place, with official documentation behind each topic. Work through it steadily and you will be ready for exam day. You can also explore more CompTIA certification study guides on the CompTIA category to keep building your skills. Have a question or tip? Leave a comment below.
Receive Updates on CompTIA PenTest+ PT0-003 Exam
Want to be notified as soon as I post? Subscribe to the RSS feed / leave your email address in the subscribe section. Share the article to your social networks with the below links so it can benefit others.
