CPTE cheat sheet

Scope and authorization: a penetration test is bounded by a written statement of work and rules of engagement; testing outside the defined IP ranges, domains, or time window is unauthorized access regardless of intent.

Methodology sequence: reconnaissance (passive then active) → enumeration → vulnerability analysis → exploitation → post-exploitation → privilege escalation → lateral movement → reporting → remediation retest.

TCP flag reference for scanning: SYN (half-open, no completed handshake), FIN/NULL/XMAS (may bypass simple filters), ACK (maps firewall rule sets), and full-connect scans that complete the handshake and are logged by the target.

Nmap timing templates T0–T5 trade speed for stealth; T4 is the common default for lab and internal work, T0/T1 for IDS-evasion scenarios.

Privilege escalation on Linux: check SUID/SGID binaries, sudo -l output, cron jobs, writable service files, kernel version versus known local exploits, and capabilities.

Privilege escalation on Windows: check service permissions (unquoted service paths, weak ACLs), token privileges (SeImpersonate), AlwaysInstallElevated, and stored credentials.

Web testing priorities: authentication and session handling, access control (IDOR, vertical/horizontal), injection (SQLi, command, template), file upload and path traversal, and deserialization.

Evidence standard: capture command output, timestamps, source IP, and screenshots for every finding; a finding without reproducible evidence is not reportable.

Severity ratings combine likelihood and impact; CVSS base score alone does not reflect business context, so document the environmental adjustment.

Recovery Point Objective (RPO) = maximum tolerable data loss measured in time; it drives backup frequency. Recovery Time Objective (RTO) = maximum tolerable downtime; it drives the recovery architecture.

Backup types: full (complete copy, resets the chain), incremental (changes since last backup of any type, fastest to write, slowest to restore), differential (changes since last full, grows each day).

The 3-2-1 rule: at least three copies of data, on two different media, with one copy offsite; a modern extension adds one immutable or offline copy to resist ransomware.

Hot site = fully equipped and near-instant failover; warm site = partially equipped with hours-to-days RTO; cold site = space and power only, longest RTO; reciprocal agreement = mutual use of a partner's facility.

A DR plan is validated by testing: tabletop exercise, then walkthrough, then simulation, then full failover. Untested plans are assumptions, not controls.

Business Impact Analysis identifies critical business functions, their dependencies, and the maximum tolerable downtime that sets each system's RTO.

Restore order follows dependency mapping: identity and DNS first, then network and storage, then data-tier services, then applications, then access layers.

Alternate processing options must be documented per critical system: manual workaround, alternate site, cloud region failover, or third-party service.

NIST SP 800-61 lifecycle: Preparation → Detection and Analysis → Containment, Eradication and Recovery → Post-Incident Activity.

Incident response plan elements: roles and contact tree, severity classification matrix, escalation thresholds, communication templates, and evidence-handling rules.

Containment choices: isolate the host from the network (keeps memory intact), power off (destroys volatile evidence), or block at the perimeter. Choose based on whether live forensics is required.

Order of volatility for collection: CPU registers and cache → RAM and swap → network state and ARP cache → running processes → disk → remote logs → archival media.

Severity is typically assigned from a combination of business impact, data sensitivity, number of affected systems, and whether the adversary is still active.

Chain of custody records who handled evidence, when, where, and why; each transfer is signed and the hash of the evidence is recorded at acquisition.

Eradication must address root cause, not just the symptom: remove persistence, patch the entry vector, and reset all credentials exposed during the incident.

Post-incident activity produces a lessons-learned report with timeline, root cause, control gaps, and assigned corrective actions with owners and dates.

Packet capture files use the pcap/pcapng format; libpcap is the capture library and tcpdump is the common CLI tool. Capture filters (BPF) reduce data at capture time; display filters reduce at analysis time.

Wireshark display filter examples: ip.addr==10.0.0.5, tcp.port==443, http.request.method=="POST", dns.qry.name contains "example", tcp.flags.syn==1 && tcp.flags.ack==0.

TCP analysis: a SYN with no SYN/ACK indicates a filtered or closed port; RST indicates rejection; retransmissions and duplicate ACKs indicate loss or a scan.

Evidence integrity: compute SHA-256 at acquisition, work from a copy, and document capture start/stop time, interface, and filter used.

NetFlow/IPFIX records metadata (5-tuple, bytes, packets, timestamps) but not payload; use it for lateral-movement and beaconing patterns, then pivot to full packet capture.

Beaconing detection looks for regular, low-jitter connections to the same destination at consistent intervals; jitter and sleep timers in implants reduce this signal.

Log correlation sources: firewall, proxy, DNS, DHCP, authentication (Windows event 4624/4625, 4768/4769 for Kerberos), and endpoint telemetry; align clocks with NTP or timestamps mislead.

Encrypted traffic analysis relies on metadata: TLS SNI, certificate subject, JA3/JA3S fingerprints, and byte-count and timing patterns rather than payload.