CompTIA PenTest+ cheat sheet

Rules of engagement (RoE) define scope, authorized targets, time windows, test boundaries, and emergency contacts; testing outside scope is unauthorized regardless of intent.

A penetration test agreement typically contains a statement of work (SOW), master service agreement (MSA), non-disclosure agreement (NDA), and RoE; the SOW states deliverables and timeline.

Authorization letters (get-out-of-jail-free letters) name the tester, the client, the scope, and the authorized dates, and should be carried during physical or on-site testing.

Scope must specify in-scope IP ranges, domains, applications, and explicitly out-of-scope assets such as production databases or third-party cloud services.

Targeted vs. full-knowledge testing: black-box (no prior info), grey-box (partial info), white-box (full source and architecture access); knowledge level changes methodology and time estimates.

Legal and compliance drivers include PCI DSS (annual external and internal testing, segmentation testing), HIPAA, GDPR, and SOX; the standard referenced for testing methodology is PTES or NIST SP 800-115.

Communication plan defines escalation paths for critical findings and incidents; a critical vulnerability discovered mid-engagement is reported immediately, not only in the final report.

A cleanup and remediation-verification phase should be agreed up front: artifacts, shells, accounts, and test data created during the engagement are removed and documented.

Reporting must include executive summary, methodology, findings with risk ratings, evidence, remediation guidance, and an appendix of tools used; risk ratings commonly use CVSS plus business context.

Passive recon uses OSINT sources without touching target infrastructure: WHOIS, DNS records, certificate transparency logs (crt.sh), search engines, and social media.

Active recon directly interacts with targets: DNS zone transfer attempts (AXFR), ping sweeps, port scans, banner grabbing, and web content discovery.

DNS enumeration record types: A (IPv4), AAAA (IPv6), MX (mail), NS (name server), TXT (SPF/DKIM/verification), CNAME (alias), SOA (zone authority), PTR (reverse).

A zone transfer succeeds only if the name server allows AXFR to the querying host; success reveals the full zone contents including internal hostnames.

Subdomain discovery combines certificate transparency, brute force with wordlists, and search engine dorking; wildcard DNS records cause false positives that must be filtered.

Nmap scan types: -sS SYN half-open (needs root), -sT full connect, -sU UDP, -sn host discovery only, -sV version detection, -O OS detection, -A aggressive (includes -sV -O -sC and traceroute).

Nmap timing templates -T0 through -T5 trade speed for stealth; -T4 is common for lab and internal testing, -T0/-T1 for evasive scanning.

Service enumeration follows port discovery: SMB (enum4linux, smbclient), SNMP (snmpwalk with community strings), LDAP (ldapsearch), and HTTP (whatweb, gobuster, nikto).

OSINT frameworks and tools include theHarvester, Maltego, Recon-ng, Shodan, and Censys; Shodan indexes exposed services and banners rather than web content.

Vulnerability scanning tools: Nessus, OpenVAS, Qualys, and Nikto for web servers; scanners identify potential issues and require manual validation to confirm exploitability.

CVSS v3.1 base score components: attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability impact; base scores range 0.0-10.0.

CVSS qualitative ratings: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.

A false positive is a reported vulnerability that does not exist; a false negative is a real vulnerability the scanner missed; both must be addressed through manual verification and multiple tool coverage.

Credentialed scans authenticate to hosts and produce more accurate results than uncredentialed scans, which see only what is exposed to the network.

CVE identifies a specific vulnerability; CVSS scores its severity; CWE classifies the weakness type; CPE identifies the affected product.

Web application testing maps to OWASP Top 10 categories, including injection, broken access control, cryptographic failures, and security misconfiguration.

Static analysis (SAST) reviews source code without executing it; dynamic analysis (DAST) tests a running application; interactive (IAST) combines instrumentation during execution.

Prioritization combines CVSS score, exploitability (public exploit or exploit kit availability), asset criticality, and compensating controls rather than raw score alone.

SQL injection payloads: ' OR '1'='1 for authentication bypass; UNION SELECT for data extraction; blind boolean and time-based (SLEEP) for inference when output is not reflected.

Cross-site scripting types: reflected (payload in request echoed in response), stored (payload persisted server-side), and DOM-based (sink manipulation in client-side JavaScript).

Command injection uses shell metacharacters (;, |, &&, `, $()) to chain attacker commands onto a vulnerable system call.

Directory traversal uses ../ sequences (and encoded variants like %2e%2e%2f) to read files outside the web root, e.g., ../../../../etc/passwd.

Password attacks: online brute force and password spraying (few passwords across many accounts, avoiding lockout) versus offline cracking of captured hashes with hashcat or John the Ripper.

Metasploit workflow: search, use, show options, set RHOSTS/LHOST, set payload, exploit/run; meterpreter sessions support post-exploitation modules.

Social engineering vectors include phishing, vishing, smishing, pretexting, and tailgating; effectiveness depends on authority, urgency, and familiarity cues.

Wireless attacks: WPA2 handshake capture and offline cracking, deauthentication frames to force reconnection, evil twin access points, and WPS PIN brute force.

Exploit selection depends on target OS, service version, architecture, and available payload; a mismatched payload or bad architecture causes a crash or failed session.

Privilege escalation on Linux: SUID binaries, sudo misconfigurations, cron jobs, writable service files, kernel exploits; on Windows: unquoted service paths, token impersonation, and missing patches.

Credential dumping: Mimikatz (lsass, sekurlsa), SAM database extraction, and /etc/shadow on Linux; NTLM hashes can be used with pass-the-hash without cracking.

Lateral movement techniques include PsExec, WMI, WinRM, SSH, SMB shares, and remote service creation; each leaves distinct event log artifacts.

Persistence mechanisms include scheduled tasks, cron entries, run keys, new local accounts, SSH authorized_keys, and service installation.

Pivoting uses a compromised host as a relay; SSH dynamic port forwarding (-D) creates a SOCKS proxy, and tools like proxychains or Chisel route traffic through it.

Exfiltration channels include DNS tunneling, HTTPS to attacker infrastructure, ICMP, and cloud storage; data volume and timing anomalies are detection signals.

Cleanup removes created accounts, uploaded tools, scheduled tasks, and modified configuration; the report documents everything created during the engagement.

Post-exploitation objectives map to the RoE: proof of access, specific data access demonstration, or full domain compromise, and testing stops at the agreed boundary.