PenTest+ PT0-003 Course Notes

This section covers 1. Engagement Management (13%). It covers the critical requirement of obtaining written authorization before initiating any intrusive testing activities. It covers understanding how to manage the defined scope of a penetration test, specifically recognizing and respecting exclusions, even when technical pathways exist. It covers ensuring testing activities align with applicable laws, regulations, and contractual obligations. Across the section, identify the trigger fact before applying the specific rule or procedure tested.

• Technical Reach vs. Authorization: Simply reaching a target does not grant permission to perform intrusive activities. Authorization is the prerequisite

• Always prioritize verifying written authorization before proceeding with any testing activity

This section covers 2. Reconnaissance and Enumeration (21%). It covers the initial information gathering phase of a penetration test, differentiating between passive and active reconnaissance techniques. It covers leveraging public records to identify potential targets during reconnaissance. It covers leveraging DNS and registration data to identify potential targets and vulnerabilities during reconnaissance. Across the section, identify the trigger fact before applying the specific rule or procedure tested.

• Passive vs. Active: Passive reconnaissance minimizes observable interaction, while active reconnaissance directly probes systems, increasing the risk of detection

• Understand the ROE: The rules of engagement are paramount. Failure to adhere to them can invalidate the entire test

This section covers 3. Vulnerability Discovery and Analysis (17%). It covers the appropriate use of authenticated and unauthenticated scanning techniques. It covers the critical process of validating findings generated by automated scanning tools. It covers leveraging CVSS scores effectively by recognizing their limitations and incorporating organizational-specific factors for accurate risk assessment. Across the section, identify the trigger fact before applying the specific rule or procedure tested.

• Authenticated scanning provides granular insights into local systems, while unauthenticated scanning offers a broader external view

• When presented with access options, prioritize authenticated scanning for detailed configuration and patch verification

This section covers 4. Attacks and Exploits (35%). It covers differentiating between password spraying and brute force attacks, understanding their distinct methodologies. Credential stuffing attacks leverage previously compromised credentials to gain unauthorized access to other services. It covers the authorized offline testing of password verifiers to determine their vulnerability without impacting live systems. Across the section, identify the trigger fact before applying the specific rule or procedure tested.

• Password spraying distributes a small number of passwords across many accounts to avoid lockout triggers, whereas brute force focuses on many guesses against a single account

• Focus on the distribution of login attempts. A wide spread suggests spraying

This section covers 5. Post-exploitation and Lateral Movement (14%). Perform bounded privilege escalation. It covers the critical task of handling evidence generated during credential dumping engagements. It covers selecting a suitable method for lateral movement within the approved target environment, emphasizing the importance of network reachability, valid credentials, and platform compatibility. Across the section, identify the trigger fact before applying the specific rule or procedure tested.

• Privilege escalation vs. Reconnaissance: Reconnaissance gathers information; privilege escalation *uses* that information to elevate access

• Focus on demonstrating the *path* to escalation, not just achieving it