New
CompTIA PenTest+
Course Design
This course is designed to optimize knowledge acquisition and skills development related to the learning objectives and related job ...
Show more
Instructor
Acquire NEXUS Academy
5
Students
enrolled
- Description
- Curriculum
About This Course
The PenTest+ Certification is designed for professionals with 10+ years of general hands-on IT experience, with at least five of those years being broad hands-on IT security experience, and 3 – 4 years in a penetration tester job role.
Upon course completion, you will be able to:
- Plan, scope, and perform information gathering as part of a penetration test.
- Perform attacks that are aligned to and fulfill legal and compliance requirements.
- Perform each phase of a penetration test using and modifying appropriate tools and use the appropriate tactics, techniques, and procedures.
- Analyze the results of each phase of a penetration test to develop a written report, effectively communicate findings to stakeholders and provide practical recommendations.
CompTIA CertMaster Perform PenTest+
Module 1 Penetration Testing: Before You Begin
-
2
1.0 Introduction -
3
1.1 Professional Conduct and Penetration Testing
-
4
1.1.1 What Is Penetration Testing?
-
5
1.1.2 Ethics, Legal, and Compliance Considerations of Penetration Testing
-
6
1.1.3 Importance and Examples of Documentation
-
7
1.1.4 Scoping and Authorization
-
8
1.1.5 Overview of the PenTest Report
-
9
1.1.6 Live Lab: Exploring the Lab Environment
-
10
1.1.7 Lesson Review -
11
1.2 Collaboration and Communication
-
12
1.2.1 Collaboration and Communication Overview
-
13
1.2.2 PenTest Team Roles and Responsibilities
-
14
1.2.3 Communicating with Clients and Team Members
-
15
1.2.4 Peer Review
-
16
1.2.5 Stakeholder Alignment
-
17
1.2.6 Root Cause Analysis
-
18
1.2.7 Escalation Path
-
19
1.2.8 Secure Distribution
-
20
1.2.9 Articulation of Risk, Severity, and Impact
-
21
1.2.10 Goal Reprioritization
-
22
1.2.11 Business Impact Analysis
-
23
1.2.12 Client Acceptance
-
24
1.2.13 Lesson Review
-
25
1.3 Testing Frameworks and Methodologies
-
26
1.3.1 Testing Frameworks and Methodologies Overview
-
27
1.3.2 Open Source Security Testing Methodology Manual (OSSTMM)
-
28
1.3.3 Council of Registered Ethical Security Testers (CREST)
-
29
1.3.4 Penetration Testing Execution Standard (PTES)
-
30
1.3.5 MITRE ATT&CK
-
31
1.3.6 Open Web Application Security Project (OWASP) Top 10
-
32
1.3.7 OWASP Mobile Application Security Verification Standard (MASVS)
-
33
1.3.8 Purdue Model
-
34
1.3.9 Threat Modeling Frameworks
-
35
1.3.10 Lesson Review
-
36
1.4 Introduction to Scripting for Penetration Testing
-
37
1.4.1 Scripting Languages
-
38
1.4.2 Bash Shell and Bash Script
-
39
1.4.3 Python
-
40
1.4.4 PowerShell
-
41
1.4.5 Use of Libraries, Functions, and Classes
-
42
1.4.6 Logic Constructs
-
43
1.4.7 Create Logic Constructs
-
44
1.4.8 Lesson Review
-
45
1.5 Module Quiz
Module 2 Applying Pre-Engagement Activities
-
46
2.0 Introduction
-
47
2.1 Define the Scope
-
48
2.1.1 Regulations, Frameworks, and Standards
-
49
2.1.2 Rules of Engagement
-
50
2.1.3 Agreement Types
-
51
2.1.4 Target Selection
-
52
2.1.5 Lesson Review
-
53
2.2 Compare Types of Assessments
-
54
2.2.1 Types of Assessments Overview
-
55
2.2.2 Web and Application Assessments
-
56
2.2.3 Network Assessments
-
57
2.2.4 Activity: Assess Environmental Considerations
-
58
2.2.5 Mobile Assessments
-
59
2.2.6 Cloud Assessments
-
60
2.2.7 Wireless Assessments
-
61
2.2.8 IoT Devices and Penetration Testing
-
62
2.2.9 Information Technology Versus Operational Technology
-
63
2.2.10 Lesson Review
-
64
2.3 Utilize the Shared Responsibility Model
-
65
2.3.1 The Shared Responsibility Model Overview
-
66
2.3.2 Hosting Provider Responsibilities
-
67
2.3.3 Customer Responsibilities
-
68
2.3.4 Penetration Tester Responsibilities
-
69
2.3.5 Third-Party Responsibilities
-
70
2.3.6 Lesson Review
-
71
2.4 Identify Legal and Ethical Considerations
-
72
2.4.1 Authorization Letters
-
73
2.4.2 Mandatory Reporting Requirements
-
74
2.4.3 Risk to the Penetration Tester
-
75
2.4.4 Documenting Pre-Engagement Activities
-
76
2.4.5 Lesson Review
-
77
2.5 Module Quiz
Module 3 Enumeration and Reconnaissance
-
78
3.0 Introduction
-
79
3.1 Information Gathering Techniques
-
80
3.1.1 Active and Passive Reconnaissance
-
81
3.1.2 Tools for Reconnaissance
-
82
3.1.3 Open-Source Intelligence (OSINT)
-
83
3.1.4 Using Shodan
-
84
3.1.5 Previously Breached Password Lists
-
85
3.1.6 Network Reconnaissance
-
86
3.1.7 Basics of Scanning
-
87
3.1.8 Perform Recon with Nmap
-
88
3.1.9 Certificate Transparency Logs
-
89
3.1.10 Information Disclosure
-
90
3.1.11 Search Engine Analysis/Enumeration
-
91
3.1.12 Network Sniffing
-
92
3.1.13 Data Manipulation
-
93
3.1.14 Lesson Review
-
94
3.2 Host and Service Discovery Techniques
-
95
3.2.1 What Is Enumeration?
-
96
3.2.2 Host Discovery
-
97
3.2.3 Scripting with Nmap
-
98
3.2.4 Activity: Scripting with Nmap
-
99
3.2.5 Banner Grabbing
-
100
3.2.6 Protocol Enumeration
-
101
3.2.7 Service Discovery
-
102
3.2.8 DNS Enumeration
-
103
3.2.9 Operating System (OS) Fingerprinting
-
104
3.2.10 Perform Enumeration with Nmap
-
105
3.2.11 Live Lab: DNS Enumeration and Reconnaissance
-
106
3.2.12 Lesson Review
-
107
3.3 Enumeration for Attack Planning
-
108
3.3.1 Attack Path Mapping
-
109
3.3.2 Manual Enumeration
-
110
3.3.3 Simple Network Management Protocol
-
111
3.3.4 Documenting Enumeration Activities
-
112
3.3.5 Activity: Document Enumeration Activities
-
113
3.3.6 Lesson Review
-
114
3.4 Enumeration for Specific Assets
-
115
3.4.1 Directory Enumeration
-
116
3.4.2 User Enumeration
-
117
3.4.3 Wireless Enumeration
-
118
3.4.4 Permission Enumeration
-
119
3.4.5 Secrets Enumeration
-
120
3.4.6 Share Enumeration
-
121
3.4.7 Web Application Firewall (WAF) Enumeration
-
122
3.4.8 Perform a Decoy Scan
-
123
3.4.9 Industrial Control Systems (ICS) Vulnerability Assessment
-
124
3.4.10 Web Crawling/HTML Scraping
-
125
3.4.11 Lesson Review
-
126
3.5 Module Quiz
Module 4 Scanning and Identifying Vulnerabilities
-
127
4.0 Introduction
-
128
4.1 Vulnerability Discovery Techniques
-
129
4.1.1 Tools for Vulnerability Discovery
-
130
4.1.2 Types of Scans
-
131
4.1.3 Container Scans
-
132
4.1.4 Application Scans
-
133
4.1.5 Scan for Cleartext Vulnerabilities
-
134
4.1.6 Network Scans
-
135
4.1.7 Activity: Scan Identified Targets
-
136
4.1.8 Host-Based Scans
-
137
4.1.9 Live Lab: Using Metasploit
-
138
4.1.10 Secrets Scanning
-
139
4.1.11 Wireless Scans
-
140
4.1.12 Use aircrack-ng to Discover Hidden Networks
-
141
4.1.13 Locate a Rogue Wireless Access Point
-
142
4.1.14 Validate Scan, Reconnaissance, and Enumeration Results
-
143
4.1.15 Applied Live Lab: Network Reconnaissance
-
144
4.1.16 Scan for Linux Vulnerabilities
-
145
4.1.17 Lesson Review
-
146
4.2 Analyzing Reconnaissance Scanning and Enumeration
-
147
4.2.1 Public Exploit Selection
-
148
4.2.2 Use Scripting to Validate Results
-
149
4.2.3 Lesson Review
-
150
4.3 Physical Security Concepts
-
151
4.3.1 Tailgating
-
152
4.3.2 Site Surveys
-
153
4.3.4 Badge Cloning
-
154
4.3.5 Lock Picking
-
155
4.3.6 Documenting Scanning and Identifying Vulnerabilities Activities
-
156
4.3.7 Activity: Identify Physical Security Concepts
-
157
4.3.8 Lesson Review
-
158
4.4 Module Quiz
-
159
4.5 Checkpoint Review
Module 5 Conducting Pentest Attacks
-
160
5.0 Introduction
-
161
5.1 Prepare and Prioritize Attacks
-
162
5.1.1 Target Prioritization
-
163
5.1.2 High-Value Asset Identification
-
164
5.1.3 Descriptors and Metrics
-
165
5.1.4 End-of-Life Software and Systems
-
166
5.1.5 Default Configurations
-
167
5.1.6 Running Services
-
168
5.1.7 Vulnerable Encryption Methods
-
169
5.1.8 Defensive Capabilities
-
170
5.1.9 Capability Selection
-
171
5.1.10 Exploit Selection and Customization
-
172
5.1.11 Documentation Procedures for Attacks
-
173
5.1.12 Dependencies
-
174
5.1.13 Consideration of Scope Limitations
-
175
5.1.14 Activity: Customize Exploits
-
176
5.1.15 Live Lab: Evaluate EOL Software & Systems
-
177
5.1.16 Applied Live Lab: Exploiting Default Configurations with Responder
-
178
5.1.17 Lesson Review
-
179
5.2 Scripting Automation
-
180
5.2.1 Types of Scripting Automation
-
181
5.2.2 PowerShell
-
182
5.2.3 Bash
-
183
5.2.4 Python
-
184
5.2.5 Breach and Attack Simulation (BAS)
-
185
5.2.6 Live Lab: Executing Scripts to Automate Tasks
-
186
5.2.7 Lesson Review
-
187
5.3 Module Quiz
Module 6 Web-based Attacks
-
188
6.0 Introduction
-
189
6.1 Web-based Attacks
-
190
6.1.1 Web Application Attacks Overview
-
191
6.1.2 Types of Web Application Attacks
-
192
6.1.3 Tools for Performing Web Application Attacks
-
193
6.1.4 Brute-Force Attack
-
194
6.1.5 Collision Attack
-
195
6.1.6 Directory Traversal
-
196
6.1.7 Request Forgery Attacks
-
197
6.1.8 Deserialization Attack
-
198
6.1.9 Injection Attacks
-
199
6.1.10 Activity: Injection Attacks
-
200
6.1.11 Insecure Direct Object Reference
-
201
6.1.12 Session Hijacking
-
202
6.1.13 Arbitrary Code Execution
-
203
6.1.14 File Inclusions
-
204
6.1.15 API Abuse
-
205
6.1.16 JSON Web Token (JWT) Manipulation
-
206
6.1.17 Live Lab: Evaluating a Database Using SQLMap
-
207
6.1.18 Live Lab: Exploiting Directory Traversal
-
208
6.1.19 Live Lab: Performing XSS
-
209
6.1.20 Live Lab: Abusing Insecure Direct Object References
-
210
6.1.21 Live Lab: Performing Lateral Movement
-
211
6.1.22 Live Lab: Performing RFI and LFI Exploitation
-
212
6.1.23 Lesson Review
-
213
6.2 Cloud-based Attacks
-
214
6.2.1 Cloud-based Attacks Overview
-
215
6.2.2 Types of Cloud-based Attacks
-
216
6.2.3 Tools for Performing Cloud-based Attacks
-
217
6.2.4 Metadata Service Attacks
-
218
6.2.5 Access Management Misconfigurations
-
219
6.2.6 Third-party Integrations
-
220
6.2.7 Resource Misconfiguration
-
221
6.2.8 Activity: Conduct Resource Misconfiguration Attacks
-
222
6.2.9 Logging Information Exposure
-
223
6.2.10 Image and Artifact Tampering
-
224
6.2.11 Supply Chain Attacks
-
225
6.2.12 Workload Runtime Attacks
-
226
6.2.13 Container Escape
-
227
6.2.14 Trust Relationship Abuse
-
228
6.2.15 Perform and Analyze a SYN Flood Attack
-
229
6.2.16 Lesson Review
-
230
6.3 Module Quiz
Module 7 Enterprise Attacks
-
231
7.0 Introduction
-
232
7.1 Perform Network Attacks
-
233
7.1.1 Network Attack Types
-
234
7.1.2 Tools for Performing Network Attacks
-
235
7.1.3 Default Credentials
-
236
7.1.4 On-Path Attack
-
237
7.1.5 Certificate Services
-
238
7.1.6 Misconfigured Services Exploitation
-
239
7.1.7 Virtual Local Area Network (VLAN) Hopping
-
240
7.1.8 Multihomed Hosts
-
241
7.1.9 Relay Attack
-
242
7.1.10 IDS Evasion
-
243
7.1.11 Live Lab: Sniffing Network Traffic
-
244
7.1.12 Applied Live Lab: Exploring the Power of Nmap NSE
-
245
7.1.13 Live Lab: Discovering Vulnerabilities with Netcat
-
246
7.1.14 Applied Live Lab: Performing a Relay Attack
-
247
7.1.15 Lesson Review
-
248
7.2 Perform Authentication Attacks
-
249
7.2.1 Authentication Attack Types
-
250
7.2.2 Tools for Performing Authentication Attacks
-
251
7.2.3 Multifactor Authentication (MFA) Fatigue
-
252
7.2.4 Pass-the-Hash Attacks
-
253
7.2.5 Pass-the-Ticket Attacks
-
254
7.2.6 Pass-the-Token Attacks
-
255
7.2.7 Kerberos Attacks
-
256
7.2.8 Lightweight Directory Access Protocol (LDAP) Injection
-
257
7.2.9 Dictionary Attacks
-
258
7.2.10 Crack a Password with John the Ripper
-
259
7.2.11 Brute-Force Attacks
-
260
7.2.12 Mask Attacks
-
261
7.2.13 Password Spraying
-
262
7.2.14 Credential Stuffing
-
263
7.2.15 OpenID Connect (OIDC) Attacks
-
264
7.2.16 Security Assertion Markup Language (Saml) Attacks
-
265
7.2.17 Live Lab: Cracking Passwords
-
266
7.2.18 Lesson Review
-
267
7.3 Perform Host-Based Attacks
-
268
7.3.1 Types of Host-Based Attacks
-
269
7.3.2 Tools for Performing Host-Based Attacks
-
270
7.3.3 Privilege Escalation
-
271
7.3.4 Credential Dumping
-
272
7.3.5 Circumventing Security Tools
-
273
7.3.6 Clear Audit Policies
-
274
7.3.7 Misconfigured Endpoints
-
275
7.3.8 Payload Obfuscation
-
276
7.3.9 User-Controlled Access Bypass
-
277
7.3.10 Shell Escape
-
278
7.3.11 Kiosk Escape
-
279
7.3.12 Library Injection
-
280
7.3.13 Process Hollowing and Injection
-
281
7.3.14 Log Tampering
-
282
7.3.15 Unquoted Service Path Injection
-
283
7.3.16 Documenting Enterprise Attacks
-
284
7.3.17 Applied Live Lab: Performing an On-Path (AiTM) Attack
-
285
7.3.18 Live Lab: Performing Privilege Escalation
-
286
7.3.19 Live Lab: Implementing Payload Obfuscation
-
287
7.3.20 Live Lab: Performing SQL Injection
-
288
7.3.21 Live Lab: Investigating with Evil-WinRM
-
289
7.3.22 Live Lab: Exploiting LOLBins
-
290
7.3.23 Live Lab: Implementing Credential Dumping
-
291
7.3.24 Lesson Review
-
292
7.4 Module Quiz
-
293
7.5 Checkpoint Review
Module 8 Specialized Attacks
-
294
8.0 Introduction
-
295
8.1 Wireless Attacks
-
296
8.1.2 Tools for Performing Wireless Attacks
-
297
8.1.3 Activity: Explore Wireless Tools
-
298
8.1.4 Wardriving
-
299
8.1.5 Bluetooth
-
300
8.1.6 Evil Twin Attack
-
301
8.1.7 Signal Jamming
-
302
8.1.8 Protocol Fuzzing
-
303
8.1.9 Packet Crafting
-
304
8.1.10 Deauthentication
-
305
8.1.11 Captive Portal
-
306
8.1.12 Wi-Fi Protected Setup (WPS) and Personal Identification (PIN) Attack
-
307
8.1.13 Lesson Review
-
308
8.2 Social Engineering Attacks
-
309
8.2.1 Types of Social Engineering Attacks
-
310
8.2.2 Tools for Performing Social Engineering Attacks
-
311
8.2.3 Phishing, Whaling, Spear phishing, and Smishing
-
312
8.2.4 Social Engineering Techniques for Gathering Information
-
313
8.2.5 Watering Hole
-
314
8.2.6 Credential Harvesting
-
315
8.2.7 Live Lab: Performing Social Engineering using SET
-
316
8.2.8 Lesson Review
-
317
8.3.9 Lesson Review
-
318
8.4 Module Quiz
Module 9 Performing Penetration Testing Tasks
-
319
9.0 Introduction
-
320
9.1 Establish and Maintain Persistence
-
321
9.1.1 Principals of Establishing and Maintaining Persistence
-
322
9.1.2 Scheduled Tasks/cron Jobs
-
323
9.1.3 Service Creation
-
324
9.1.4 Reverse and Bind Shells
-
325
9.1.5 Add New Accounts
-
326
9.1.6 Obtain Valid Account Credentials
-
327
9.1.7 Registry Keys
-
328
9.1.8 Command and Control (C2) Frameworks
-
329
9.1.9 Backdoor
-
330
9.1.10 Activity: Maintain Persistence
-
331
9.1.11 Create a Backdoor with Metasploit
-
332
9.1.12 Rootkit
-
333
9.1.13 Browser Extensions
-
334
9.1.14 Tampering Security Controls
-
335
9.1.15 Live Lab: Configuring Reverse and Bind Shells
-
336
9.1.16 Live Lab: Establishing Persistence and Other Post-Exploitation Activities
-
337
9.1.17 Lesson Review
-
338
9.2 Move Laterally through Environments
-
339
9.2.1 Lateral and Horizontal Movement
-
340
9.2.2 Scan for Open Ports from a Remote Computer
-
341
9.2.3 Techniques for Moving Laterally through Environments
-
342
9.2.4 Tools for Moving Laterally through Environments
-
343
9.2.5 Pivoting
-
344
9.2.6 Relay Creation
-
345
9.2.7 Enumeration
-
346
9.2.8 Perform Enumeration of MSSQL with Metasploit
-
347
9.2.9 Service Discovery
-
348
9.2.10 Perform a Scan Using Zenmap
-
349
9.2.11 Bypass Windows Firewall
-
350
9.2.12 Window Management Instrumentation (WMI)
-
351
9.2.13 Window Remote Management (WinRM)
-
352
9.2.14 Lesson Review
-
353
9.3 Staging and Exfiltration
-
354
9.3.1 Fundamentals of Staging and Exfiltration
-
355
9.3.2 Getting Data from a Target
-
356
9.3.3 Hide Files with OpenStego
-
357
9.3.4 Alternate Data Streams
-
358
9.3.5 Applied Live Lab: Staging and Exfiltration Using ADS
-
359
9.3.6 Lesson Review
-
360
9.4 Cleanup and Restoration
-
361
9.4.1 Cleanup and Restoration Procedures
-
362
9.4.2 Activity: Implement Cleanup and Restoration Activities
-
363
9.4.3 Documenting Penetration Testing Tasks
-
364
9.4.4 Lesson Review
-
365
9.5 Module Quiz
Module 10 Reporting and Recommendations
-
366
10.0 Introduction
-
367
10.1 Penetration Test Report Components
-
368
10.1.1 Creating the Penetration Test Report
-
369
10.1.2 Reporting Considerations
-
370
10.1.3 Report Components and Definitions
-
371
10.1.4 Documentation Specifications and Format Alignment
-
372
10.1.5 Risk Scoring
-
373
10.1.6 Test Limitations and Assumptions
-
374
10.1.7 Lesson Review
-
375
10.2 Analyze Findings and Remediation Recommendations
-
376
10.2.1 Analyzing Findings and Developing Recommendations Overview
-
377
10.2.2 Technical Controls
-
378
10.2.3 Administrative Controls
-
379
10.2.4 Operational Controls
-
380
10.2.5 Physical Controls
-
381
10.2.6 Activity: Administrative and Operational Controls
-
382
10.2.7 Lesson Review
-
383
10.3 Module Quiz
Module A PenTest+ PT0-003 Practice Exams
-
384
A.0 I Introduction
-
385
A.1 Prepare for CompTIA PenTest+ Certification
-
386
A.1.1 Why Should I Take a Certification Exam?
-
387
A.1.2 Exam Details for PenTest+ (PT0-003)
-
388
A.1.3 How to Take the Certification Exam
-
389
A.1.4 Tips for Taking the Exam
-
390
A.2 Practice Exams
-
391
A.2.1 Exam Practice 1: Engagement Management
-
392
A.2.2 Exam Practice 2: Reconnaissance and Enumeration
-
393
A.2.3 Exam Practice 3: Vulnerability Discovery, and Analysis
-
394
A.2.4 Exam Practice 4: Attacks and Exploits
-
395
A.2.5 Exam Practice 5: Post-exploitation and Lateral Movement
-
396
A.2.6 PenTest+ PT0-003 Exam Practice
Glossary
Course details
Duration
4 weeks
Lectures
348
Quizzes
49
Level
Advanced
obtained after course assessment
1 year
any
Popular courses
