CompTIA PenTest+ PT0-002The Complete Beginner's Guide

Penetration Testing Methodology

Objective 1.1 · Planning Scoping

Scope, Rules of Engagement, and Legal

Objective 1.2 · Planning Scoping

Threat Modelling for PenTest Planning

Objective 1.1

Third-Party and Supply Chain Risk in Scope

Objective 1.2

Bug Bounty Programs and Responsible Disclosure

Objective 1.2

Red Team Exercises vs Penetration Tests

Objective 1.1

Purple Team Operations

Objective 1.1

Operational Security (OPSEC) for PenTesters

Objective 1.2

OSINT and Passive Reconnaissance

Objective 2.1 · Recon Enumeration

Active Scanning and Enumeration

Objective 2.2 · Recon Enumeration

Vulnerability Identification

Objective 2.3 · Recon Enumeration

Nmap Scanning Techniques

Objective 2.2

BloodHound and Active Directory Enumeration

Objective 2.2

Passive DNS Reconnaissance Techniques

Objective 2.1

Shodan and Censys for Asset Discovery

Objective 2.1

WHOIS, Certificate Transparency, and ARIN

Objective 2.1

Google Dorking for OSINT

Objective 2.1

LinkedIn and Social Media OSINT

Objective 2.1

Maltego and Recon-ng Frameworks

Objective 2.1

Advanced Nmap: Scripting Engine (NSE)

Objective 2.2

Masscan and ZMap for Fast Port Scanning

Objective 2.2

SMB Enumeration with enum4linux and CrackMapExec

Objective 2.2

LDAP and Active Directory Enumeration

Objective 2.2

SNMP Enumeration Techniques

Objective 2.2

Web Fuzzing: Dirbusting and Parameter Discovery

Objective 2.2

Subdomain Enumeration and Takeover

Objective 2.1

API Endpoint Enumeration

Objective 2.2

Network Exploitation

Objective 3.1 · Attacks Exploits

Web Application Attacks

Objective 3.2 · Attacks Exploits

Social Engineering Attacks

Objective 3.3 · Attacks Exploits

Post-Exploitation Techniques

Objective 3.4 · Attacks Exploits

Wireless and RF Attacks

Objective 3.5 · Attacks Exploits

Metasploit Framework for PenTesters

Objective 3.1

Burp Suite for Web Application Testing

Objective 3.2

SQL Injection: Union, Blind, Time-Based

Objective 3.2

Cross-Site Scripting (XSS) Types

Objective 3.2

CSRF and SSRF Attacks

Objective 3.2

Command Injection and Directory Traversal

Objective 3.2

IDOR and Broken Access Control

Objective 3.2

Mimikatz and Credential Extraction

Objective 3.4

Privilege Escalation on Linux

Objective 3.4

Privilege Escalation on Windows

Objective 3.4

Lateral Movement Techniques

Objective 3.4

Pivoting and Tunnelling Through Networks

Objective 3.4

Cloud Pentesting: AWS and Azure

Objective 3.5

Mobile Application Testing

Objective 3.5

Phishing Campaigns in Penetration Testing

Objective 3.3

Physical Security Testing Techniques

Objective 3.3

Command and Control (C2) Framework Concepts

Objective 3.4

Exploit Frameworks: Core Impact and Canvas

Objective 3.1

Buffer Overflow Exploitation Concepts

Objective 3.1

Remote Code Execution (RCE) Vulnerabilities

Objective 3.1

SMB Exploitation: EternalBlue and PsExec

Objective 3.1

Kerberoasting and AS-REP Roasting

Objective 3.4

DCSync Attack and Domain Replication

Objective 3.4

Golden Ticket and Silver Ticket Attacks

Objective 3.4

LSASS Credential Dumping Methods

Objective 3.4

Post-Exploitation File Transfer Techniques

Objective 3.4

Persistence Mechanisms: Scheduled Tasks, Registry

Objective 3.4

RDP Exploitation and BlueKeep

Objective 3.1

Web Shells and Maintaining Access

Objective 3.2

XXE Injection Attacks

Objective 3.2

Insecure Deserialization Attacks

Objective 3.2

JWT Token Attacks

Objective 3.2

OAuth 2.0 and SSO Attacks

Objective 3.2

VLAN Hopping and Network Pivoting

Objective 3.1

DNS Poisoning and Spoofing

Objective 3.1

WPA3 and Modern Wireless Attacks

Objective 3.5

Bluetooth and BLE Attack Surface

Objective 3.5

Evil Twin and Rogue AP Attacks

Objective 3.5

AWS Pentesting: IAM Escalation, S3 Exposure

Objective 3.5

Azure Pentesting Techniques

Objective 3.5

Container Escape Techniques

Objective 3.5

NTLM Relay Attacks and Responder

Objective 3.4

Active Directory ACL Abuse

Objective 3.4

AS-REP Roasting vs Kerberoasting

Objective 3.4

IoT and SCADA/ICS Pentesting Concepts

Objective 3.5

Pentesting AI and ML Systems

Objective 3.5

Pass-the-Hash and Pass-the-Ticket Attacks

Objective 3.4

Subdomain Takeover in Pentesting

Objective 3.2

ARP Spoofing and MITM Attacks

Objective 3.1

Writing Penetration Test Reports

Objective 4.1 · Reporting Comms

Remediation Recommendations

Objective 4.2 · Reporting Comms

Debriefing the Client After a PenTest

Objective 4.2

CVSS Scoring in Penetration Test Reports

Objective 4.1

Finding Severity Classification

Objective 4.1

Technical vs Executive Report Sections

Objective 4.1

Re-Testing and Validation Testing

Objective 4.2

Penetration Testing Tools

Objective 5.1 · Tools Scripts

Scripting and Automation for PenTest

Objective 5.2 · Tools Scripts

Hashcat and Password Cracking

Objective 5.1

John the Ripper

Objective 5.1

Hydra for Credential Brute-Forcing

Objective 5.1

Payload Generation with msfvenom

Objective 5.1

Cobalt Strike Beacon Concepts

Objective 5.1

PowerShell for Penetration Testing

Objective 5.2

Bash Scripting for Automation

Objective 5.2

Python for Penetration Testing

Objective 5.2

ProxyChains and SOCKS Tunneling

Objective 5.1

Wireshark for Pentesters

Objective 5.1

Impacket Suite for Windows Exploitation

Objective 5.1

Evil-WinRM and Remote Management

Objective 5.1

Ligolo-ng and Chisel for Tunneling

Objective 5.1

Source Code Review for Vulnerabilities

Objective 5.2