CSPT study plan

Draft a rules-of-engagement and scoping document for a fictional client that specifies in-scope CIDRs and hosts, testing windows, escalation contacts, data-handling limits, and explicitly prohibited techniques

Build an isolated attack-and-defense lab (attacker VM, intentionally vulnerable web application, and a Windows host suitable for later directory work) and verify that snapshot rollback restores a clean state

Enumerate the lab web application's authentication, session, and access-control surfaces, mapping each user-controlled input to the trust boundary it crosses

Demonstrate three access-control failures (insecure direct object reference, privilege escalation by parameter tampering, forced browsing to a privileged page) and capture the raw request and response for each

Exploit injection flaws in the lab (SQL injection, OS command injection, server-side template injection) and record the exact payload, the server response, and the root cause for each

Test and document SSRF, unrestricted file upload, and insecure deserialization paths, including any filter or allowlist bypasses that were required

Chain a server-side request path to reach an internal-only service and capture the transition from an external web request to an internal response

Write remediation guidance for each web finding that names the specific control to implement (parameterized queries, allowlisting, content-type and signature validation) instead of generic advice

Differentiate bind, reverse, and staged payload behaviour by executing each in the lab and capturing the resulting traffic in a packet capture

Demonstrate one network-level credential attack in the lab (relay or hash-based authentication) and document the protocol weakness that made it possible

Configure local port forwarding and a SOCKS proxy through a compromised host to prove reachability into a simulated internal segment that was previously unreachable

Compare three pivoting methods (SSH tunnelling, proxychains, and a lightweight tunnel such as Chisel) and document the stability, throughput, and detection tradeoffs of each

Enumerate an Active Directory lab domain: users, groups, computers, trusts, SPNs, and delegation settings, using both native utilities and a third-party collection tool

Execute at least two credential-based attack paths (Kerberoasting, AS-REP roasting, or ACL abuse) and capture the artefacts obtained from each

Trace a path from a low-privilege domain user to Domain Admin and annotate every edge with the specific misconfiguration that enables it

Write a targeted remediation for each edge in the traced path (delegation removal, ACL cleanup, password policy change, administrative tiering)

Perform passive and active reconnaissance against a practice range: DNS and OSINT collection, subdomain enumeration, service and version scanning, and content discovery

Build a consolidated asset and service inventory from the collected output and rank it by exposure and business context

Triage automated scanner findings by manually confirming or refuting at least five items, and record the false-positive rate of the scanner used

Write a reusable validation checklist that defines reproducibility steps, required evidence, affected scope, and explicit false-positive exit criteria

Identify and exploit three Windows privilege escalation vectors (service misconfiguration, unquoted service paths, and token or impersonation privilege abuse) and document each successful escalation

Identify and exploit three Linux privilege escalation vectors (SUID binaries, sudo misconfiguration, and scheduled-task or writable-path abuse)

Run at least two local enumeration tools and manually verify every candidate they surface before acting on it

Document the detection signal each escalation technique would generate for a defender monitoring the host

Convert the lab findings into a client-ready report containing an executive summary, technical findings, severity ratings, and a prioritized remediation roadmap

Apply a consistent evidence-handling process across the engagement: hashing, timestamping, redaction of sensitive data, and storage that preserves integrity

Write remediation guidance for every finding that names a responsible owner, an alternative compensating control, and a verifiable retest criterion

Review your own report against an engagement-close checklist covering scope coverage, evidence completeness, and justification of each rating

Complete timed practice sets across all eight domains and log every missed item with its root cause (knowledge gap, misread question, or tooling error)

Re-demonstrate the three weakest objectives from the log until each is performed twice without reference material

Deliver a fifteen-minute verbal walkthrough of one full engagement lifecycle, from scoping through reporting, without notes

Audit your study notes for accuracy on any fact you flagged as uncertain and mark unresolved items for verification before exam day