CompTIA PenTest+ Certification Training

1.0 PLANNING AND SCOPING

Explain the importance of planning for an engagement.
· Understanding the target audience
· Rules of engagement
· Communication escalation path
· Resources and requirements Budget
· Impact analysis and remediation timelines
· Disclaimers
· Technical constraints
· Support resources

Explain key legal concepts
· Contracts
· Environmental differences
· Written authorization

Explain the importance of scoping an engagement properly.
· Types of assessment
· Special scoping considerations
· Target selection
· Strategy
· Risk acceptance
· Tolerance to impact
· Scheduling
· Scope creep
· Threat actors

Explain the key aspects of compliance-based assessments.
· Compliance-based assessments, limitations and caveats
· Clearly defined objectives based on regulations

2.0 INFORMATION GATHERING AND VULNERABILITY IDENTIFICATION

Given a scenario, conduct information gathering using appropriate techniques.
· Scanning
· Enumeration
· Packet crafting
· Packet inspection
· Fingerprinting
· Cryptography
· Eavesdropping
· Decompilation
· Debugging
· Open Source Intelligence Gathering

Given a scenario, analyze vulnerability scan results.
· Credentialed vs. non-credentialed
· Types of scans
· Container security
· Application scan
· Considerations of vulnerability scanning

Given a scenario, analyze vulnerability scan results.
· Asset categorization
· Adjudication
· Prioritization of vulnerabilities
· Common themes

Explain the process of leveraging information to prepare for exploitation.
· Map vulnerabilities to potential exploits
· Prioritize activities in preparation for penetration test
· Describe common techniques to complete attack

Explain weaknesses related to specialized systems.
· ICS
· SCADA
· Mobile
· IoT
· Embedded
· Point-of-sale system
· Biometrics
· Application containers
· RTOS

3.0 ATTACKS AND EXPLOITS

Compare and contrast social engineering attacks.
· Phishing
· Elicitation
· Interrogation
· Impersonation
· Shoulder surfing
· USB key drop
· Motivation techniques

Given a scenario, exploit network-based vulnerabilities.
· Name resolution exploits
· SMB exploits
· SNMP exploits
· SMTP exploits
· FTP exploits
· DNS cache poisoning
· Pass the hash
· On-path attack (previously known as man-in-the-middle attack)
· DoS/stress test
· NAC bypass
· VLAN hopping

Given a scenario, exploit wireless and RF-based vulnerabilities.
· Evil twin
· Deauthentication attacks
· Fragmentation attacks
· Credential harvesting
· WPS implementation weakness
· Bluejacking
· Bluesnarfing
· RFID cloning
· Jamming
· Repeating

Given a scenario, exploit application-based vulnerabilities.
· Injections
· Authentication
· Authorization
· Cross-site scripting (XSS)
· Cross-site request forgery (CSRF/XSRF)
· Clickjacking
· Security misconfiguration
· File inclusion
· Unsecure code practices

Given a scenario, exploit local host vulnerabilities.
· OS vulnerabilities
· Unsecure service and protocol configurations
· Privilege escalation
· Default account settings
· Sandbox escape
· Physical device security

Summarize physical security attacks related to facilities.
· Piggybacking/tailgating
· Fence jumping
· Dumpster diving
· Lock picking
· Lock bypass
· Egress sensor
· Badge cloning

Given a scenario, perform post-exploitation techniques.
· Lateral movement
· Persistence
· Covering your tracks

4.0 PENETRATION TESTING TOOLS

Given a scenario, use Nmap to conduct information gathering exercises.
· SYN scan (-sS) vs. full connect scan (-sT)
· Port selection (-p)
· Service identification (-sV)
· OS fingerprinting (-O)
· Disabling ping (-Pn)
· Target input file (-iL)
· Timing (-T)
· Output parameters

Compare and contrast various use cases of tools.
· Use cases
· Tools

Given a scenario, analyze tool output or data related to a penetration test.
· Password cracking
· Pass the hash
· Setting up a bind shell
· Getting a reverse shell
· Proxying a connection
· Uploading a web shell
· Injections

Given a scenario, analyze a basic script (limited to Bash, Python, Ruby, and PowerShell).
· Logic
· I/O
· Substitutions
· Variables
· Common operations
· Error handling
· Arrays
· Encoding/decoding

5.0 REPORTING AND COMMUNICATION

Given a scenario, use report writing and handling best practices.
· Normalization of data
· Written report of findings and remediation
· Risk appetite
· Storage time for report
· Secure handling and disposition of reports

Explain post-report delivery activities.
· Post-engagement cleanup
· Client acceptance
· Lessons learned
· Follow-up actions/retest
· Attestation of findings

Given a scenario, recommend mitigation strategies for discovered vulnerabilities.
· Solutions
· Findings
· Remediation

Explain the importance of communication during the penetration testing process.
· Communication path
· Communication triggers
· Reasons for communication
· Goal reprioritization