EC-Council LPT Master cheat sheet

A repeatable methodology fixes scope, rules of engagement, phases, and reporting templates before testing begins, so any qualified tester on the same target produces comparable, auditable results.

PTES phases: pre-engagement interactions, intelligence gathering, threat modeling, vulnerability analysis, exploitation, post-exploitation, reporting.

Measurable coverage is expressed as tested assets divided by in-scope assets, with each finding carrying a reproducible request/response or command transcript.

Risk scoring: CVSS base score captures intrinsic severity; environmental and temporal metrics adjust for exposure and exploit maturity.

Re-test criteria: a finding is closed only when the original exploit vector is re-run and fails, not when a patch ticket is marked resolved.

Chain-of-custody logging records timestamp, tester identity, source IP, target, and payload hash for every exploitation action.

Sampling rule: if in-scope hosts exceed the time budget, document the sampling method and confidence level rather than silently testing a subset.

Threat modeling maps adversary goals to assets and trust boundaries; each identified threat becomes a test case with a pass/fail criterion.

SQLi detection: inject a single quote and compare boolean-true versus boolean-false variants; a persistent difference confirms injection independent of error messages.

UNION-based extraction requires matching column count and compatible data types; ORDER BY n incrementing until failure reveals the column count.

Blind SQLi uses time delays (e.g., database-specific sleep functions) or boolean inference; response timing must be compared against a baseline of repeated clean requests.

XSS classes: reflected (payload in immediate response), stored (payload persisted server-side), DOM-based (sink such as innerHTML receives attacker-controlled source).

Context determines encoding: HTML body needs entity encoding, attributes need quoting plus encoding, script blocks need JavaScript escaping, URLs need percent-encoding.

LFI payloads target include/require sinks with traversal sequences and null-byte or wrapper tricks; PHP filters and data wrappers can convert file read into code execution.

RFI succeeds only when remote file inclusion is enabled; the include target must be reachable and the response must show execution, not just retrieval.

WAF bypass levers: case variation, comment insertion, alternate encodings, whitespace substitution, and equivalent SQL operators or function synonyms.

Report structure: executive summary, scope and methodology, risk overview, detailed findings with evidence, remediation guidance, and appendices.

Each finding states title, affected asset, severity with scoring rationale, reproduction steps, business impact, evidence, and a specific remediation with verification steps.

Executive summary omits exploit payloads and speaks in business-risk terms: data exposure, regulatory consequence, operational disruption, financial loss.

Remediation advice must be actionable and layered: immediate mitigation, root-cause fix, and detective control, each with an owner-agnostic description.

Evidence hygiene: redact credentials, tokens, and personal data while preserving enough detail for a technical reader to reproduce the issue.

Severity consistency: identical vulnerability classes receive identical base scoring unless environmental factors are explicitly documented.

Management buy-in depends on mapping findings to assets the business already tracks, so remediation can be budgeted and tracked as normal work.

A findings tracker with status, owner, and re-test date converts a static report into a measurable remediation program.

The methodology is delivered as licensed courseware through authorized training partners; the exam validates application of the phases, not memorization of slide text.

Phase order matters: reconnaissance precedes scanning, scanning precedes exploitation, and post-exploitation precedes reporting; skipping phases weakens evidentiary quality.

Reconnaissance splits into passive (public records, search engines, certificate transparency) and active (direct interaction with target infrastructure).

Scanning distinguishes host discovery, port scanning, service/version detection, and vulnerability validation as separate, separately logged activities.

Exploitation is scoped to proof of access; data exfiltration beyond the agreed proof is out of bounds unless explicitly authorized.

Post-exploitation covers privilege level, persistence assessment, lateral reach, and data sensitivity classification, each documented before cleanup.

Cleanup restores the environment: remove uploaded tools, revert configuration changes, and confirm with the client that no residual access remains.

Exploit development stages: identify the bug, control the instruction pointer or equivalent, find space for payload, redirect execution, and stabilize.

Stack overflow offset is measured with a cyclic pattern; the offset to the return address equals the position of the overwritten bytes in the pattern.

Bad-character identification: send an ascending byte sequence, inspect memory at the buffer, and exclude any byte that terminates or transforms.

Return-to-libc and ROP bypass non-executable stack by chaining gadgets ending in a return instruction to invoke existing code such as system().

ASLR defeat requires an information leak or a non-randomized module; PIE shifts the base address of the main binary, so leaks must target a mapped region.

Shellcode constraints: no null bytes in string-copied buffers, position independence, and size limits imposed by the vulnerable buffer.

Heap exploitation targets allocator metadata and function pointers; use-after-free requires reclaiming freed memory with attacker-controlled content.

A working exploit must be reproducible from a clean snapshot, with the exact target version, offsets, and payload documented.

Windows privilege context: user token integrity level and group membership determine access; SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege enable token theft escalation.

Unquoted service paths with spaces allow binary planting in a writable directory earlier in the search order.

DLL search order hijacking exploits writable directories in the loader path; missing DLLs in writable locations are direct escalation candidates.

Linux SUID binaries run with file-owner privileges; check for GTFOBins-style shell escapes and for binaries that honor environment variables like PATH.

Cron jobs and systemd timers executing writable scripts or relative-path commands are a standard local escalation vector.

Kernel exploits require exact version matching; a failed attempt can panic the host, so snapshot or confirm rollback before running.

Credential material on disk: Windows SAM and LSA secrets, Linux /etc/shadow, SSH keys, and configuration files containing plaintext service passwords.

Sudo misconfiguration includes NOPASSWD entries, wildcard arguments, and allowed binaries with documented shell-escape behavior.

Enumeration precedes exploitation: collect OS version, kernel, patch level, users, groups, services, scheduled tasks, mounts, and network shares before choosing a vector.

Windows escalation order of likelihood: misconfigured service permissions, unquoted paths, token privileges, stored credentials, then kernel exploits.

Linux escalation order of likelihood: sudo rights, SUID/SGID binaries, writable cron or systemd units, capabilities, then kernel exploits.

Linux capabilities such as cap_setuid or cap_dac_read_search on a binary grant targeted privilege without full SUID, and are often overlooked.

Group membership matters: docker, lxd, disk, and adm groups on Linux frequently yield root-equivalent access through mounts or device reads.

Always capture proof at the new privilege level (id, whoami /priv, hostname) and record the exact command path used to reach it.

Escalation attempts that fail must be logged with the error observed, because negative results are part of the assessment evidence.

Lateral movement pivots through compromised hosts using port forwarding, SOCKS proxies, or tunneling to reach segments unreachable from the tester's origin.

Trust relationships are the primary lateral path: shared local admin passwords, domain trusts, SSH authorized_keys reuse, and cached credentials.

Out-of-the-box reasoning reframes the objective: if the front door is patched, examine the supply chain, the backup path, the help desk, or the API behind the UI.

Chaining low-severity findings can produce high impact; document the chain as a single finding with each link as a step.

Assume-breach testing starts from a simulated foothold and measures detection and containment rather than initial access.

Physical and social vectors are in scope only when the rules of engagement explicitly authorize them and define handling for recovered material.

Creative paths still require authorization: a novel technique outside the agreed scope is documented as a recommendation, not executed.

The exam is delivered fully online with remote proctoring; identity verification, a live camera feed, and screen monitoring are conditions of a valid sitting.

Prohibited during the exam: unauthorized notes, secondary devices, third-party assistance, and any tool that captures or relays exam content.

Item exposure undermines the credential for every holder; sharing question content violates the candidate agreement regardless of intent.

A result is subject to invalidation when proctoring flags anomalous behavior, and the candidate bears the burden of disputing the record.

Practical value of the credential rests on demonstrated methodology and reporting quality, not on the number of tools memorized.

Continuing relevance requires re-testing skills against current systems; certification alone does not certify current competence on new platforms.

Ethical boundary: techniques learned for the exam apply only under written authorization; unauthorized testing is a legal matter, not a technical one.

Pre-exam checks: system compatibility test, camera and microphone verification, stable bandwidth, and a cleared desk within camera view.

Identity verification typically requires a government-issued photo ID matching the registered name; mismatches block admission.

Environment rules: no other people in the room, no dual monitors, no virtual machines, and no screen-sharing or remote-control software running.

A proctor may request a 360-degree room scan and a view of the desk surface before the timer starts.

Technical failure protocol: contact proctor support immediately; do not restart the session unilaterally, since the attempt may be logged as abandoned.

Time management on a practical exam: allocate a fixed budget per phase and reserve a defined block for report writing before the timer expires.

Rules of engagement define in-scope targets, excluded systems, testing windows, allowed techniques, emergency contacts, and data-handling constraints.

Written authorization must be signed by someone with authority over every in-scope asset; third-party-hosted systems require the provider's consent too.

A get-out-of-jail letter names the tester, the client, the scope, and the authorization window, and is carried during active testing.

Testing windows protect production availability; destructive techniques such as denial-of-service or password spraying can lock accounts and require explicit approval.

Stop conditions: discovery of evidence of a prior real compromise triggers immediate notification and suspension of testing.

Data handling: client data encountered during testing is minimized, encrypted at rest, and destroyed on an agreed schedule after report delivery.

Every finding needs a reproducible artifact: full request and response, command line, timestamp, and target identifier.

Screenshots supplement but never replace text evidence, because text is searchable, diffable, and survives report conversion.

Log at the moment of action, not from memory afterward; a testing journal with timestamps is the source of truth for the report.

Hash sensitive captured files at collection time to demonstrate they were not altered before analysis.

Distinguish confirmed findings from suspected ones; an unvalidated scanner alert is a lead, not a finding, and must be labeled as such.

Version every report draft and record reviewer comments so the final deliverable has a traceable review history.

Enumerate content with directory and file discovery, then compare results against the application's own sitemap and JavaScript bundles for hidden endpoints.

Parameter discovery extends beyond visible forms: check headers, cookies, JSON bodies, and path segments for injectable inputs.

Technology fingerprinting via response headers, error pages, cookie names, and static file hashes narrows the exploit set before testing.

Authentication surfaces include login, password reset, registration, and API token issuance; each is a separate test target.

Map trust boundaries: where the browser talks to the API, where the API talks to internal services, and where data crosses tenant lines.

Record every discovered endpoint with method, parameters, and authentication requirement to build a coverage baseline for measurement.

Establish the privilege level and host role first, then decide whether the host is a target of value or a pivot point.

Pivoting tools create a tunnel from the tester through the compromised host; document every route so the client can close it later.

Credential harvesting on a foothold informs lateral reach; store recovered secrets encrypted and report their existence, not their values.

Persistence is tested only when authorized; any artifact created must be recorded and removed during cleanup.

Detection testing measures whether the client's monitoring observed the activity, which requires timestamped attacker-side logs for correlation.

Cleanup verification: re-check each modified host for removed tools, reverted configuration, and closed accounts, then obtain client sign-off.

Remediation is specific: name the configuration setting, code change, or patch level, not a general category such as 'improve input validation'.

Defense in depth pairs a root-cause fix with a compensating control so a single regression does not reopen the finding.

Prioritization weighs exploitability, exposure, and business criticality of the asset rather than raw severity alone.

Re-test scope mirrors the original proof: same endpoint, same payload class, same privilege objective.

A finding is verified closed only with fresh evidence; a vendor advisory claiming a fix is not verification.

Track time-to-remediate per severity band to give management a measurable trend across engagements.

Reproduce the target environment's exact version, patch level, and configuration before developing; offsets rarely transfer across builds.

A crash is not a controlled exploit; distinguish denial of service from reliable code execution in every claim.

Reliability testing runs the exploit repeatedly from a clean state and records the success rate.

Debugger-assisted development uses breakpoints on the faulting instruction to confirm control of the instruction pointer.

Payload staging separates a small first-stage stager from a larger second stage when buffer space is limited.

Document dependencies: libraries, architecture, and mitigations present (ASLR, DEP, stack canaries) that the exploit assumes absent.

Windows: whoami /priv lists token privileges; systeminfo reports patch level; net user and net localgroup enumerate accounts and group membership.

Windows service permissions are checked with access-control tools; writable service binaries or directories are escalation candidates.

Linux: id, sudo -l, and getcap -r / reveal identity, delegated commands, and file capabilities respectively.

Linux SUID discovery uses find with the -perm -4000 predicate; SGID uses -perm -2000.

Scheduled execution on Linux lives in cron directories, user crontabs, and systemd timers; writable units or scripts are escalation paths.

Network position is established with interface, route, and ARP listings before any pivot attempt.

Critical findings discovered mid-engagement are reported immediately through the agreed escalation channel, not held for the final report.

The technical audience needs reproduction steps and evidence; the executive audience needs impact and decision options.

Debrief meeting agenda: scope recap, headline risks, top findings, remediation priorities, and open questions.

Avoid blame framing; describe the condition and its consequence so the receiving team can act without defensiveness.

Report language stays precise about certainty: 'confirmed' versus 'observed' versus 'suspected' carry different evidentiary weight.

Deliverables include the report, raw evidence package, and a findings tracker suitable for the client's ticketing system.

Authorization must cover the specific technique; permission to test a web application does not extend to its hosting provider's infrastructure.

Personal data encountered during testing triggers privacy obligations that may require immediate notification and minimization.

Testing third-party components embedded in the target requires the component owner's consent or explicit exclusion.

Accidental discovery of unrelated vulnerabilities on out-of-scope systems must be reported to the owner and not exploited further.

Retaining client data beyond the agreed period is a contractual and legal exposure, not merely poor practice.

Public disclosure of findings requires written client approval and an agreed timeline.

Coverage metrics: assets tested over assets in scope, endpoints exercised over endpoints discovered, and authentication states tested.

Quality metrics: findings with reproducible evidence over total findings, and re-test pass rate on the first attempt.

Severity distribution across engagements reveals whether the assessment reached deep enough or stopped at scanner output.

Time-per-phase tracking exposes phases that were compressed, which correlates with missed findings in post-exploitation.

Peer review of the report before delivery catches unsupported severity scores and unreproducible steps.

Benchmarking against a fixed test case set gives an objective measure of tester consistency across engagements.

SQLi to data exposure: confirm injection, enumerate schema, extract a bounded proof sample, and stop at the agreed data limit.

XSS to session compromise: demonstrate script execution in the victim context and describe the reachable actions without harvesting real user sessions.

LFI to code execution: file read proves the primitive; escalation requires a writable log, session file, or wrapper that the target will execute.

RFI impact depends on outbound reachability from the target; verify egress before claiming exploitability.

Chaining stored XSS with an administrative action converts a medium finding into a privilege escalation narrative.

Every chain is documented as a sequence with the precondition at each step, so remediation can break the chain at the cheapest link.

Read the full task list before acting; sequence work so shared reconnaissance serves multiple objectives.

Keep a running notes file with timestamps and command output, since the report is graded on evidence quality.

Validate each flag or objective immediately; an unverified result discovered late may be unreproducible under time pressure.

Reserve the final block for report writing; a strong technical result with a weak report loses points.

If a technique fails repeatedly, record the failure and move on; partial coverage beats a stalled single objective.

Stay within proctoring rules: no external assistance, no unapproved tools, and no attempt to capture exam content.

Match the tool to the phase: discovery tools for enumeration, proxy interception for application testing, debuggers for exploit development.

Interception proxies reveal parameters hidden from rendered pages, including headers and JSON fields.

Automated scanners produce leads; manual validation converts a lead into a confirmed finding with evidence.

Rate-limit automated requests to avoid outages and account lockouts that violate the rules of engagement.

Record tool versions in the report so results can be reproduced with the same behavior.

Prefer the least invasive technique that proves the finding; destructive proof requires explicit authorization.

Industry-accepted reports include a risk rating methodology section so readers can interpret severity consistently.

Findings are ordered by risk, with an index mapping each finding to its affected assets and remediation owner.

Appendices carry raw evidence, tool output, and scope details that would otherwise interrupt the narrative.

Acceptance criteria are agreed before testing: report format, evidence depth, debrief date, and re-test terms.

A report that a technical reader cannot reproduce from is a failed deliverable regardless of finding count.

Deliver in a tamper-evident format and confirm receipt through the agreed channel.

The candidate agreement binds the holder to confidentiality of exam content for the life of the credential.

Remote proctoring records identity, environment, and session behavior; consent to monitoring is a precondition of sitting.

Anomalies such as off-screen attention, unauthorized devices, or another voice in the room are flagged for review.

Disputes follow the vendor's appeals process, which relies on the proctor's recorded evidence.

Holding the credential implies a duty to test only under authorization and to report discovered risk honestly.

Credential value depends on the holder's demonstrated practice, so maintaining skills is part of upholding it.

A scanner alert becomes a finding only after manual reproduction with a controlled request and observed response.

Boolean-difference testing distinguishes a real injection point from an error page that reflects any malformed input.

Time-based confirmation requires repeated measurements against a baseline to exclude network jitter.

Reflected payloads must be checked for encoding and context to confirm execution rather than mere reflection.

File inclusion claims require proof of retrieval or execution, not just a 200 status on a traversal attempt.

Document the negative tests performed; they demonstrate rigor and bound the finding's scope.

Capture the pre-escalation identity and the post-escalation identity in the same session to prove the change.

Record the exact command or exploit used, including arguments and any file dropped on the host.

Avoid kernel exploits on production hosts unless rollback is confirmed; a panic can cause an outage.

Post-escalation actions stay within the agreed proof: read a marker file or list a protected directory rather than altering data.

Remove dropped binaries and revert any account or permission change before leaving the host.

Report the escalation path as a chain of preconditions, since remediation may target any link.

Reframe the objective when the direct path is blocked: the goal is access to the asset, not exploitation of a specific bug.

Trust boundaries between integrated services often carry weaker authentication than the public interface.

Business logic flaws require understanding intended workflow; test sequences out of order, repeated, and skipped steps.

Default or shared credentials across environments are a lateral path that bypasses perimeter controls.

Document creative paths as recommendations when they fall outside the authorized scope.

Every novel technique still requires evidence, reproducibility, and a remediation recommendation.

The debrief presents headline risk and remediation priorities before the written report is finalized.

Closure requires confirmation that no residual access, tools, or accounts remain on client systems.

Deliver the evidence package with an index so the client can locate the proof for any finding.

Agree the re-test window and success criteria at closure so remediation has a measurable endpoint.

Retain engagement records only for the contracted period, then destroy them with confirmation.

A lessons-learned note on methodology gaps improves the next engagement's repeatability.

Confirm the exact build and patch level; exploits are version-specific and a mismatch risks a crash.

Verify the mitigation state: DEP, ASLR, stack canaries, and control-flow integrity change the required technique.

Identify the vulnerable service's privilege level; a network service running as SYSTEM or root yields immediate escalation.

Check for authentication requirements and whether the vector is pre- or post-authentication, since that changes exposure.

Snapshot or confirm rollback before running any exploit that could destabilize the host.

Record the exploit source, version, and any modification made to it for reproducibility.

The practical exam tests application of methodology across phases, so preparation should rehearse a full engagement end to end.

Time-boxed practice builds the habit of reserving report-writing time, which is a graded component.

Weak domains are identified by rehearsal results, not by familiarity with tool names.

Rehearsal environments should mirror the target operating systems and web stacks named in the exam objectives.

Note-taking discipline during rehearsal transfers directly to exam evidence quality.

Exam integrity rules apply during rehearsal only in the sense that real targets require authorization.

Map each technical finding to a business asset and a consequence the executive already tracks, such as revenue system downtime.

Quantify where possible: number of records exposed, accounts at risk, or hours of disruption under a plausible scenario.

Present remediation as tiered options with cost and risk trade-offs rather than a single demand.

Use the client's own risk terminology and severity scale to avoid translation friction.

Show trend data across engagements to demonstrate program improvement and justify continued investment.

Close with clear decisions requested: approvals, owners, and dates, so the report drives action rather than filing.