CREST CPSA case studies
CREST CPSA · Put your knowledge to work in context.
The CREST Practitioner Security Analyst (CPSA) is an entry-level certification that tests a candidate's knowledge of assessing operating systems and common network services, together with an intermediate level of web application security testing. It is aimed at people moving into hands-on penetration testing roles: CREST describes successful candidates as qualified for hands-on pen test roles, indicative of around two years of experience. The CREST CPSA case studies are 5 cases and about 2,131 words.
1Scoping a Test When the Client Wants Everything by Friday
You are the lead tester on a new engagement. The client's CTO signs a statement of work that says 'full penetration test of all external and internal systems, delivered in 5 working days.' During kickoff you learn the estate is 3 external /24 ranges (roughly 600 live hosts), an internal /16 with about 1,400 servers, and a payment application that is PCI-DSS in scope.
474 words, about 2 min2A Host That Answers Ping But Nothing Else
During an internal assessment you find host 10.20.4.51 responds to ICMP echo but returns 'filtered' for TCP 22, 80, 443, 445 and 3389 in an nmap SYN scan. A colleague says 'it's firewalled, move on.' You notice the TTL of the ICMP replies is 63 and consistent, the host is in a server VLAN, and the asset register lists it as a 'backup appliance.' You have authorisation to test the internal range but not to cause disruption.
407 words, about 2 min3The Login Page That Behaves Differently Under Load
You are testing a web login at https://portal.example.test. Manual testing shows a normal 200 response for valid and invalid credentials, with a generic 'invalid username or password' message and a rate-limit of 5 attempts per minute per IP.
398 words, about 2 min4The Backup File in the Web Root
While reviewing a web application you discover that https://app.example.test/backup/ returns a directory listing containing app-2024-03-01.zip and db.sql.gz. You download them (authorised) and find the zip contains source code with a hard-coded database password in config.php, and db.sql.gz contains a full dump including password hashes and customer PII.
416 words, about 2 min5The Read-Only Database Account That Wasn't
You are assessing a database-backed application. The app connects to PostgreSQL as user app ro , which the DBA describes as 'read-only, least privilege.' You have application-level access and can reach the DB directly from the test host (authorised).
436 words, about 2 min