CSPT case studies
CSPT · Put your knowledge to work in context.
CSPT is an acronym used by more than one credential programme, and in the profile this page follows it refers to a practical, hands-on penetration-testing certification. The exam is aimed at security practitioners who already work with offensive tooling and want a formal benchmark of their ability to run an engagement end to end: agreeing scope and rules of engagement, performing reconnaissance, validating vulnerabilities rather than trusting scanner output, exploiting networks and web applications, moving through identity and directory-service attack paths, escalating privileges on Windows and Linux, and writing findings that a client can actually act on. The CSPT case studies are 5 cases and about 3,380 words.
1The Patient ID That Belongs to Someone Else
Northwind Health engages you to test a bespoke patient-portal web application and the API behind it. The signed RoE lists two in-scope hosts (portal.northwind-health.example, api.northwind-health.example), permits authenticated testing with two provided accounts created for synthetic patients, and forbids denial-of-service, social engineering, and any testing outside 08:00-18:00 UTC.
677 words, about 3 min2Shadow Cloud, Leaked Key, End-of-Life VPN
Halcyon Logistics gives you three ranges (198.51.100.0/24, 192.0.2.0/24, 203.0.113.128/25) and the domain halcyon-log.example. Four hours of passive recon produces: certificate transparency logs showing 61 unique subdomains; nine resolving inside 198.51.100.0/24; four resolving to 203.0.113.16-19, outside every listed range; two CNAMEs to a third-party applicant-tracking provider.
659 words, about 3 min3The Second NIC You Were Told Not to Use
You hold local administrator on JUMP01 (10.10.10.15), a Windows server in the DMZ, reached from a web shell on an in-scope application server. JUMP01 has two NICs: 10.10.10.15/24 in the DMZ and 172.16.5.15/24 in manufacturing.
655 words, about 3 min4A Domain Admin Is Logged In, and EDR Is Watching
Meridian Insurance: 8,500 users, one AD forest, 12 domain controllers, and an EDR agent the client has set to alert-only for the test window. Your authenticated internal test sprays three passwords at two attempts per account, across all 8,500 users, with no lockouts.
734 words, about 4 min5Someone Else Was Here First
On day three of an internal test you beacon from WS-0412, an in-scope marketing workstation. You find a scheduled task named 'AdobeUpdateTask' running C: .exe every four minutes, plus an outbound TLS connection roughly every 60 seconds to 198.51.100.77:443.
655 words, about 3 min