CompTIA PenTest+

The best information is collected without touching the target. You gather public data about people, domains, infrastructure and code, and turn it into a list of likely entry points.

• Open source intelligence methods
• DNS, WHOIS and certificate records
• Search engines, social media and public staff listings
• Exposed code, credentials and cloud storage
• Internet-wide scanning data
• Organizing and verifying what you find

You build A reconnaissance dossier on a lab organization, with every finding sourced.

Touching the target gives precision and leaves traces. You discover hosts and services, enumerate shares, directories and accounts, and choose scan settings that balance speed against noise.

• Host discovery and port scanning with Nmap
• Service and version detection
• Enumerating SMB, SNMP, LDAP and DNS
• Web content and directory discovery
• Cloud asset enumeration
• Scan timing, evasion and the risk of detection

You build An enumeration report for a lab network listing hosts, services, accounts and shares.

Scanners produce leads, not answers. You run and tune scans, validate results by hand, research exploits, and decide which weaknesses form a realistic attack path.

• Network, web and credentialed scanning
• Validating findings and removing false positives
• Searching exploit databases and advisories
• Chaining weaknesses into attack paths
• Prioritizing by impact and effort
• Planning an attack within the rules

You build A validated vulnerability list and attack plan for a lab network.

Networks give attackers a way in and a way across. You exploit name resolution and protocol weaknesses, crack captured credentials, attack wireless networks and use exploitation frameworks with care.

• Poisoning name resolution and relaying credentials
• On-path attacks and ARP spoofing
• Password attacks: cracking and spraying
• Exploiting network services with frameworks
• Wireless attacks against weak configurations
• Network segmentation bypass

You build A lab write-up that captures and cracks credentials, then uses them to reach a new host.

Web applications are exposed by design. You find and exploit injection, scripting, broken authentication, request forgery and access control flaws, in sites and in the APIs behind them.

• Intercepting and modifying requests
• SQL and command injection
• Cross-site scripting and request forgery
• Authentication and session weaknesses
• Server-side request forgery and file inclusion
• API authorization testing
• Deserialization and logic flaws

You build A test report covering six confirmed web vulnerabilities, each with a proof of concept.

Once on a machine, privilege decides everything. You escalate on Windows and Linux, attack directory services, and exploit cloud identity, storage and metadata weaknesses.

• Windows privilege escalation paths
• Linux privilege escalation paths
• Credential theft and pass-the-hash
• Kerberos and directory attacks
• Cloud identity and permission abuse
• Exposed storage, secrets and metadata services
• Container escape basics

You build A privilege escalation chain from an ordinary user to administrator in a lab domain.

People and doors are part of the attack surface. You design phishing and phone-based tests within the rules, assess physical entry controls, and measure results in a way that teaches rather than blames.

• Designing a phishing campaign
• Phone pretexting and impersonation
• Tailgating and badge weaknesses
• Physical bypass and device drops
• Authorization and safety for human testing
• Reporting results without blame

You build A social engineering test plan with safeguards, scripts and measurement.

Public exploits rarely work unchanged. You read and modify exploit code, write scripts that automate recon and attacks, and understand memory corruption well enough to recognize it.

• Python, Bash and PowerShell for testers
• Automating scanning and parsing output
• Reading and adapting public exploit code
• Buffer overflow fundamentals
• Payload types and delivery
• Evasion basics and why they matter

You build A script that automates enumeration and a modified exploit that works on a lab target.

A foothold is the start of the impact story. You gather credentials and data, test persistence, assess what an attacker could collect, and clean up everything you leave behind.

• Situational awareness on a compromised host
• Credential and secret harvesting
• Persistence techniques and their detection
• Sensitive data discovery
• Simulating data exfiltration safely
• Cleanup and restoring the target

You build A post-exploitation log for a lab host with persistence tested and cleaned up.

Segmentation claims are tested by moving through the network. You tunnel through compromised hosts, reuse credentials and tickets, move between systems with remote execution, and show how far one foothold reaches.

• Pivoting with tunnels and port forwarding
• Pass-the-hash and pass-the-ticket movement
• Remote execution over standard protocols
• Command and control concepts
• Testing segmentation and trust boundaries
• Mapping the path an attacker took

You build A lateral movement map across a three-segment lab network, with each hop explained.

The report is what the client keeps. You write findings with evidence and business impact, rate severity consistently, advise on practical fixes and retest to confirm they worked.

• Report structure for technical and executive readers
• Evidence and reproducible steps
• Rating severity and risk
• Writing remediation advice that can be followed
• The debrief meeting
• Retesting and closing findings

You build A full penetration test report with executive summary, findings and remediation plan.

One scenario walks the full test. You scope it, gather information, find and exploit weaknesses, move through the network, clean up and deliver a report that the client can act on.

• Scoping and rules of engagement
• Reconnaissance, enumeration and analysis
• Exploitation and privilege escalation
• Post-exploitation and lateral movement
• Reporting and debriefing

You build A completed engagement file: scope, evidence, attack path and final report.