CSPT study guide
CSPT · Work through your exam, one topic at a time.
CSPT is an acronym used by more than one credential programme, and in the profile this page follows it refers to a practical, hands-on penetration-testing certification. The exam is aimed at security practitioners who already work with offensive tooling and want a formal benchmark of their ability to run an engagement end to end: agreeing scope and rules of engagement, performing reconnaissance, validating vulnerabilities rather than trusting scanner output, exploiting networks and web applications, moving through identity and directory-service attack paths, escalating privileges on Windows and Linux, and writing findings that a client can actually act on. The CSPT study guide has 8 sections and about 3,318 words.
01Engagement Management, Scoping and Rules of Engagement
Every engagement rests on three documents: the NDA (confidentiality both ways), the master services agreement (liability, insurance, indemnity), and the statement of work (the actual task, deliverables, timeline, and fee). The SOW is what defines your authority.
696 words, about 3 min02Reconnaissance and Information Gathering
Passive reconnaissance gathers information without touching client infrastructure: WHOIS and RIR records, ASN and netblock mapping, DNS records (A, MX, NS, TXT/SPF/DMARC), certificate transparency logs, search engine and code repository dumps, cloud storage bucket naming, and metadata embedded in published documents. Commercial and open sources (Shodan, Censys) index hosts you have not scanned, which keeps you quiet but does not make the data authoritative.
330 words, about 2 min03Vulnerability Analysis and Validation
Automated scanners generate both false positives (version-based guesses, backported patches, banner spoofing) and false negatives (business logic flaws, chained conditions, authenticated-only issues). Your job is validation : reproduce the condition manually, confirm the vulnerable code path, and record minimal, non-destructive proof.
329 words, about 2 min04Network Exploitation and Pivoting
Network exploitation starts with an exposed service or valid credential set. Credential attacks must respect lockout policy - password spraying with a small candidate list across many accounts, not brute force against one account.
361 words, about 2 min05Web Application Exploitation
Effective web testing begins with attack surface mapping: authentication mechanisms, session handling, roles and privilege boundaries, API endpoints, input sinks, file handling, and third-party integrations. Test both authenticated and unauthenticated states, and with at least two accounts of different privilege so that authorization flaws (IDOR/BOLA, forced browsing, function-level access control) can be proven rather than suspected.
333 words, about 2 min06Identity and Directory Service Attack Paths
Active Directory attacks are built on Kerberos and NTLM fundamentals. Kerberos pre-authentication protects AS-REQ; accounts with it disabled can be AS-REP roasted.
321 words, about 2 min07Privilege Escalation (Windows and Linux)
Enumerate before exploiting: kernel and distribution version, SUID/SGID binaries, sudo -l output including allowed arguments, file capabilities, cron and systemd timers, writable service unit files, PATH abuse, NFS exports with no root squash , group memberships such as docker or lxd , readable credential files, and exposed SSH keys. GTFOBins classifies binaries that can break out of their intended function - but presence alone is not a finding; you need a path to execution in the current context.
309 words, about 2 min08Reporting, Evidence Handling and Remediation Guidance
A penetration test report has an executive layer and a technical layer, and questions frequently probe the difference. The executive summary states overall risk posture, the most material themes, and business consequences in plain language - no CVE identifiers, no payloads.
639 words, about 3 min