Study guide · Core notes
Reference notes for scope and agreements, reconnaissance, vulnerability analysis, the attacks V3 names, and the cleanup that ends an engagement.
How to read these notes: Items tagged Extra sit outside the PT0-003 objective bullets, such as topics that belonged only to retired PT0-002. Learn the unmarked items first. New to the exam? Start with the overview for the format, the 750 passing score, and the June 17, 2025 retirement of PT0-002. Control definitions that this exam assumes are on the Security+ notes. These notes name techniques so you can recognize them on an authorized test. They are not steps for attacking a system.
Domain 1 is 13 percent. The test starts when the agreement says it starts, and it stops when the agreement says it stops.
| Document | What it decides |
|---|---|
| Non-disclosure agreement | What you may not reveal. It does not list the hosts you may test. |
| Master service agreement | The ongoing legal terms between the firms. A single test still needs a statement of work. |
| Statement of work | This engagement: targets, work, and deliverables. If a host is missing here, it is out of scope. |
| Terms of service | The rules of a service you use. A public website's terms are not your permission to test that site. |
Exclusions are systems and techniques you must not touch. Test cases say what you will try. The escalation process names who hears a critical finding during the test. The testing window is the hours you may work. A finding at 02:00 is still out of bounds if the window is business hours only.
Scope can name CIDR ranges, domains, IP addresses, and URLs. Assessment types on the objectives are web, network, mobile, cloud, API, application, and wireless. A cloud account you can see in a console is not automatically in scope if a third party owns it.
The hosting provider secures the platform it operates. The customer secures data, identities, and configuration. The tester is responsible for staying inside the authorization. A third party that hosts a system needs its own permission. An exposed storage bucket is often the customer's configuration, not proof the provider failed.
An authorization letter is written permission. Without it, the same activity can be a crime. Mandatory reporting means some discoveries, including evidence of a crime, have a required path. Risk to the tester includes legal exposure if you exceed scope. Curiosity is not a defense.
Peer review checks the work before the client relies on it. Stakeholder alignment keeps the goal shared. Root cause analysis asks why the flaw exists, not only which host has it. The escalation path is who you call. Secure distribution means the report does not travel through a personal inbox. Goal reprioritization changes the plan when the client or the evidence says the original goal is wrong.
Articulate risk, severity, and impact in the client's words. A business impact analysis says what the finding does to operations. Client acceptance is the point where the client agrees the engagement, including cleanup, is complete. Do not close the file while a tester account still exists.
Use the model the question names. They are not interchangeable labels for "security."
| Name | Use it when the question is about |
|---|---|
| PTES | The penetration test as a process, from pre-engagement through reporting. |
| OSSTMM | A security testing methodology manual. It is not a list of exploit payloads. |
| CREST | A professional body and its standards for testers. It is not a kill-chain diagram. |
| MITRE ATT&CK | A matrix of tactics and techniques. It is not one straight line of steps. |
| OWASP Top 10 | The most important web application risk classes. The objectives use the name Open Worldwide Application Security Project. |
| OWASP MASVS | A verification standard for mobile apps. It is not the web Top 10 with a new cover. |
| Purdue model | Levels in an industrial network, from the process up to the enterprise. It is not a web-test checklist. |
| STRIDE | Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege. |
| DREAD | Damage, reproducibility, exploitability, affected users, and discoverability. It rates a threat. It is not CVSS. |
| OCTAVE | A risk evaluation that starts from assets and operational impact. It is not a port scanner. |
Domain 1 includes the written result. Change the depth for the audience. Do not change the facts.
Align the format to what the client asked for. Define the terms you use. Score risk with a stated method. The components on the objectives are an executive summary, the methodology, detailed findings, an attack narrative, and recommendations with remediation guidance. State the test's limitations and assumptions. A host you were not allowed to touch is a limitation, not a clean bill of health.
Legal and ethical limits still apply after the last packet. Quality control catches a finding you cannot reproduce. Artificial intelligence can help you edit, and it can also invent a host. A model is not a source. If you cannot show the evidence, the sentence does not belong in the report.
Hardening, parameterized queries, multifactor authentication, encryption, process-level fixes, patching, key rotation, certificate management, a secrets manager, network segmentation, and infrastructure security controls. Parameterized queries keep data from changing a statement. A secrets manager is where the key lives, not in the repository you just cloned.
Administrative controls include role-based access, a secure development life cycle, password requirements, and policies. Operational controls include job rotation, time-of-day limits, mandatory vacations, and training. Physical controls include an access-control vestibule, biometrics, and video. Recommend the control that matches the finding. A camera does not fix SQL injection.
Domain 2 is 21 percent. Say whether you sent a packet before you name the tool.
Open-source intelligence includes social media, job boards, code repositories, cached pages, and password dumps that are already public. DNS lookups and reverse lookups can be done against public data or by asking a server. Certificate transparency logs show names that received a certificate. Cryptographic flaws include weak or expired certificates you can see without logging in. Search-engine analysis finds pages and files the site already published.
Network reconnaissance and protocol scanning send traffic. TCP and UDP scans learn which services answer. Banner grabbing reads the greeting a service sends. HTML scraping and web crawling read the application by requesting it. Network sniffing watches traffic, including IoT and operational-technology protocols, when you are allowed to be on that segment. Information disclosure is anything the target reveals that it should have kept.
A listing that mentions a product is a clue about what the company uses. Operating-system fingerprinting is what the live host's responses imply. Do not treat the clue as proof of the host in front of you.
Enumeration names a specific thing: a user, a share, a permission, or a secret.
Match the tool to the question. The objectives say the point is the use case, not a vendor feature list.
| Tool | Job on this exam |
|---|---|
| Shodan and Censys | Search hosts and services that are already exposed on the internet. They do not crack a password hash. |
| theHarvester, Hunter.io, Maltego, Recon-ng, SpiderFoot | Collect and relate public identity and host data. Maltego is the link graph. Hunter.io is associated with email addresses. |
| WHOIS, nslookup, dig, DNSdumpster, Amass | Registration and DNS. Amass is the name you associate with gathering many DNS names. |
| Wayback Machine | Historical copies of pages. A deleted file can still be in the archive. |
| Nmap and NSE | Host, port, and scripted checks. A script is still an active test. |
| Wireshark and tcpdump | Capture and read packets. They do not score a CVE by themselves. |
| WiGLE, InSSIDer, Aircrack-ng | Wireless discovery and assessment. WiGLE is a location database of observed networks. InSSIDer surveys what is nearby. Aircrack-ng is the wireless suite, not an email harvester. |
| OSINTframework.com | A map of open-source categories. It is a directory of techniques, not a scanner you point at a host. |
The objectives ask you to modify a script, not to memorize a payload.
Bash, Python, and PowerShell are the three named languages. PowerShell is the usual fit for a Windows host. Bash fits a shell on a Linux tester workstation. Python is the usual fit when the script imports a library.
A loop repeats. A conditional chooses a branch. A Boolean operator combines true and false. A string operator joins or compares text. An arithmetic operator calculates a number. If the script should stop when a name is empty, that is a conditional, not a longer loop.
Libraries, functions, and classes are how a script avoids copying the same block. On this exam, "modify the script" usually means change the input list, the condition, or the output, then say what the change does to the data you already collected.
A separate tools-and-code domain is Extra. That was PT0-002 domain 5. PT0-003 asks about scripting here and again under attack automation.
Domain 3 is 17 percent. A clean banner is not a clean host.
| Scan | What it can see |
|---|---|
| SAST | Source code, and infrastructure-as-code, without running the application. |
| DAST | The running application from the outside. |
| IAST | The running application with instrumentation inside it. |
| SCA | Third-party components and known issues in those components. |
| Container and sidecar | The image, and a companion container beside the application. The sidecar can hold a proxy, an agent, or a secret the main image does not show. |
| Authenticated host scan | Local patches and configuration, because the scanner logs in. An unauthenticated scan can miss all of that and still look clean. |
| Stealth scan | A network scan that avoids a full completed connection. It is still active. It is not a passive Shodan search. |
| Secrets scan | Keys, passwords, and tokens in content you are allowed to read. TruffleHog is the tool name to associate with that job. |
| Wireless | SSID, channel, and signal strength. That is not a CVE scan of a web application. |
| ICS | Manual assessment or traffic from a mirror port. An aggressive probe can stop a process. Follow the method in the agreement. |
Other tool names in this domain: Nikto for a web server, Greenbone OpenVAS and Tenable Nessus for vulnerability scanning, BloodHound for Active Directory relationships, Grype and Trivy for container and related content, Kube-hunter for Kubernetes, and PowerSploit as a PowerShell module set for checking a Windows environment. Know the job. The objectives are not a feature tour.
A scanner row is a hypothesis until you check it.
A true positive is real and reported. A false positive is reported and not real. A false negative is real and missed. Scan completeness asks whether you looked at the hosts in scope. Troubleshooting the configuration matters when the scanner never logged in, skipped a network, or timed out.
Public exploit selection means matching a confirmed finding to a known public issue so the report is specific. It does not mean running something against a host you have not validated, and it does not mean writing a new exploit on the exam.
A short script can re-check a result, such as whether a name still resolves or a header is still missing. If the script and the scanner disagree, say so. Do not average them into a smoother story.
These are in the vulnerability domain. They are in scope only when the agreement says so.
Domain 4 is 35 percent. Name the technique and the constraint. A clever idea outside the scope statement is the wrong answer.
| Technique | Recognize it by |
|---|---|
| CVSS, CVE, CWE, EPSS | CVE is the identifier. CWE is the weakness class. CVSS is severity. EPSS is the chance of exploitation. End-of-life software and default configurations raise priority because the vendor path or the shipped settings are weak. |
| On-path, relay, VLAN hop | On-path sits in a conversation. A relay forwards an authentication or a connection. VLAN hopping crosses a segmentation boundary the design thought was closed. A multihomed host already sits on two networks. |
| Spray, stuff, brute, dictionary, mask | Spray uses few passwords and many accounts, to avoid a lockout. Stuffing reuses breached pairs. Brute force spends many guesses on one account. A dictionary is a word list. A mask is a pattern, such as a known prefix. |
| MFA fatigue | Repeated approval prompts until a person accepts one. It is not a faster guess of the password. The report should say the prompt worked because a person approved it. |
| Pass-the-hash, ticket, token | The hash, the Kerberos ticket, or the token is reused without recovering the original secret. BloodHound maps the Active Directory path. hashcat and John work offline. Hydra and Medusa try secrets against a live service. |
| SSRF and CSRF | SSRF makes the server call a URL, which is how a metadata service gets reached. CSRF uses the victim's browser. They are not two names for the same bug. |
| XSS, SSTI, SQLi, LDAP injection | XSS runs in the browser. A template injection runs on the server. SQL injection changes a database statement. LDAP injection changes a directory query. Parameterized queries are the remediation the objectives name for injection. |
| LFI, RFI, traversal, IDOR | Local file inclusion uses a file on the server. Remote file inclusion pulls a file from elsewhere. Traversal walks a path. IDOR changes an identifier and reaches another user's object because authorization is missing. |
| JWT | The service accepts claims it did not verify. The finding is the broken trust, not a longer token. |
| Cloud | Metadata credentials, overly broad IAM, a public bucket, a public service, image or pipeline tampering, a container escape, and a trust between accounts. ScoutSuite and Prowler audit configuration. Pacu is the AWS framework on the tool list. Docker Bench checks a Docker host. Kube-hunter checks Kubernetes. |
| Wireless and social | An evil twin imitates a trusted network. Jamming denies the radio. Deauthentication forces clients off an access point. A WPS PIN is a weak enrollment path; the control is to turn WPS off. Phishing is email, smishing is text, vishing is voice, whaling aims at executives, and a watering hole is a site the targets already visit. |
| Specialized systems | Mobile findings include extra permissions and jailbreak or root. AI findings include prompt injection and model manipulation. OT findings include register changes, CAN bus, Modbus, plaintext, and replay. NFC, RFID, bluejacking, and Bluetooth spam are the close-range names. Bluejacking sends unsolicited Bluetooth messages. |
Host techniques to recognize, without treating them as procedures: privilege escalation, credential dumping, a bypass of a security tool, a kiosk or shell escape, library injection, process injection, log tampering, and an unquoted service path. Living-off-the-land binaries are programs the operating system already has, so the activity can look like administration. Breach-and-attack simulation tools on the list are Caldera, Infection Monkey, and Atomic Red Team. They emulate techniques in an authorized test. They do not replace the report.
Domain 5 is 14 percent. Access that continues is persistence. Access that spreads is lateral movement.
Scheduled tasks and cron jobs, a new service, a new account, a registry key, a browser extension, a web shell, a trojan, a rootkit, and a command-and-control framework. A bind shell listens on the target. A reverse shell calls out. Tampering with a security control, such as stopping a log, is also on the list. The report has to say you did it, because cleanup has to undo it.
Pivoting uses a host you can reach to reach a network you cannot route to directly. A relay forwards a connection or an authentication. Along the way you may find more services, more credentials, or strings in files. Channels named in the objectives include SMB, RDP, VNC, SSH, LDAP, RPC, FTP, Telnet, HTTP and HTTPS, LPD, JetDirect, and DCOM. WMI and WinRM are Windows remote-management paths. Cleartext services expose secrets on the wire.
Living-off-the-land names on the list include netstat, net, cmd, explorer, ftp, mmc, rundll32, msbuild, route, and strings or findstr. They are already on the host. Covenant, CrackMapExec, Impacket, Netcat, sshuttle, Proxychains, Metasploit, PsExec, and Mimikatz are separate tools you brought or launched. sshuttle and Proxychains are the names to associate with a pivot or a proxy. If you brought it, cleanup has to account for it.
Encryption and compression make a copy smaller and harder to inspect. Covert channels on the list are steganography, DNS, ICMP, and HTTPS. Other paths are email, another cloud account, cloud storage, an alternate data stream, a text-storage site, and a mounted virtual drive. The agreement decides what you may take. Proving a path exists is not the same as taking a customer database the statement of work did not allow.
The engagement is not over when the last finding is written.
No. They are an original summary of the public PT0-003 objectives, version 3.0. Confirm the current PDF with CompTIA before you book.
Extra marks a useful idea the PT0-003 objective bullets do not name, such as the retired PT0-002 tools domain. Learn the unmarked items first.
Written authorization that names the target, the allowed techniques, and the testing window. A target that is not on that list stays out of the test until the client adds it.
Turn the tables into recall, then test them.
Exam format, the 750 passing score, five domain weights, and the PT0-002 retirement date.
Reference notes for scope, reconnaissance, scans, attack names, and cleanup.
40 recall cards in five decks, plus memory notes for agreements, scan types, and cleanup.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert structured data between JSON and YAML with formatting and validation.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and PenTest+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.
Certi