PenTest+ study plan

Build a passive footprint of a fictional target organization from public sources only, logging at least 10 data points (domains, mail records, employee roles, hosted services) with the source for each.

Enumerate a lab domain actively: attempt a zone transfer, brute-force subdomains, and mine certificate transparency logs, then reconcile the three result sets into one host list.

Run service/version detection and default-category scripts against the lab subnet, then hand-verify at least five open ports to confirm the service actually answering.

Extract information from SMB, LDAP, SNMP, and DNS on lab hosts to obtain usernames, share names, OS versions, and domain naming context.

Rate each discovered host by likely attack value and justify the ranking in one sentence per host.

Execute three complete exploitation chains on isolated lab machines (recon, verify vulnerability, exploit, prove access, capture evidence) using three different vulnerability classes such as default credentials, an unpatched network service, and weak TLS configuration.

Perform an online password spray and an offline hash crack against lab accounts, and record the lockout threshold and detection artifact each attempt would generate.

Set up both a bind shell and a reverse shell with a staged payload, and write down which one survives the lab firewall and why.

Demonstrate a relay or spoofing attack (ARP, LLMNR/NBT-NS, or SMB relay) in the isolated lab and capture the resulting credential material.

Write a one-paragraph prevention note for each exploit chain you completed.

Exploit SQL injection, reflected and stored XSS, directory traversal, and command injection against a self-hosted deliberately vulnerable web application, capturing proof for each.

Test a lab API for broken object-level authorization and mass assignment, and document the request/response pairs that prove the flaw.

Capture and crack a WPA2 handshake in an isolated lab, or stand up a rogue access point and record what a client reveals when it associates.

Draft a pretexting scenario and a phishing email for an authorized internal test, including the consent and reporting safeguards that make it legitimate.

Map every successful web attack to a specific remediation control (input validation, output encoding, parameterized queries, least privilege).

Run an unauthenticated scan and an authenticated scan of the same lab hosts, then explain each major difference in results.

Triage a scanner export: eliminate false positives by manual verification and document why each rejected item was rejected.

Decompose the CVSS vector of three real CVEs affecting lab software and state in plain language what each metric contributes.

Rank the top 10 validated findings by exploitability, business impact, and exposure, and justify the ordering.

Confirm at least five scanner findings manually with a proof-of-concept or configuration check.

Draft a rules-of-engagement document for a fictional client covering scope, exclusions, testing windows, escalation path, data handling, and stop-work conditions.

Build a scope worksheet listing in-scope addresses, out-of-scope assets, emergency contacts, and the authorization evidence you must hold before touching anything.

Write both an executive summary and a technical finding write-up from the same vulnerability data, adjusting vocabulary and length for each audience.

Classify 10 testing activities as permitted, requiring additional written authorization, or unlawful without it, citing the reasoning.

Assemble a reusable report skeleton with sections for methodology, findings, risk rating, evidence, and retest guidance.

Escalate privileges on a lab host using a documented local technique and record the enumeration steps that identified the path.

Dump credentials on the compromised host and use the harvested material to authenticate to a second host.

Establish persistence on a lab machine, then remove it and verify by re-checking every location you modified.

Pivot through the compromised host to reach a host on a segmented network and prove reachability.

Move a dummy file out of the lab over an allowed channel and name the log source that would have caught it.

Re-drill the ten techniques you were slowest on and rebuild them into a personal one-page command reference with no copied text.

Complete two timed lab ranges end to end, each within 90 minutes, without consulting notes.

Convert every missed practice question from weeks 1 through 6 into a flashcard and review the full deck twice.

Re-run one enumeration scenario and one exploitation scenario from memory, then diff your output against your week 1 and week 2 notes.

Sit a full-length timed practice exam covering all five domains and score every section separately.

Re-study only the two weakest sections, then retake 30 questions from those sections and compare scores.

Write a final report on your week 6 lab chain using the week 5 template, including a retest plan for each finding.

Rehearse the reporting and scoping decisions you got wrong on the mock exam by rewriting each missed item as a mini scenario with the correct action.