PJPT study plan

Map the seven exam domains into a personal tracker and mark the four heaviest (1, 2, 4, 5) as priority blocks

Configure a lab (two Linux VMs, one Windows VM, one intentionally vulnerable web app) and verify connectivity and snapshots

Execute passive OSINT against a practice target: WHOIS, DNS records, certificate transparency, and search-engine dorking

Draft a rules-of-engagement and scope template covering authorization, time window, excluded hosts, and emergency contact

Write a one-page engagement kickoff memo for a fictional client using that template

Perform active reconnaissance: zone transfer attempts, subdomain brute force, and virtual host discovery against the practice target

Run host discovery and full TCP/UDP port scans, then compare service detection results between two scanners

Capture and document every open port with service, version, and confidence level

Build a reusable recon checklist that separates passive from active steps

Time-box a full recon pass and record how long each stage took

Enumerate SMB, SSH, HTTP, and DNS services and record banners, shares, users, and versions

Use directory and file brute forcing against the web app and classify findings by severity

Identify at least three plausible entry points and rank them by likelihood and impact

Document enumeration output in a structured findings table with evidence screenshots

Practice writing a finding in the standard format: title, description, evidence, impact, remediation

Exploit at least two known-vulnerable services in the lab and capture proof of access

Perform password attacks: online brute force against a lab service and offline cracking of a captured hash

Demonstrate a public exploit against the practice web app and explain each step of the chain

Practice shell stabilization and basic post-exploitation enumeration on a compromised host

Write a proof-of-concept section for each successful exploit with reproduction steps

Stand up a small Active Directory lab with a domain controller and two member hosts

Enumerate the domain: users, groups, computers, trusts, and share permissions using built-in and community tools

Execute and document at least two credential-access techniques against the lab domain

Perform a lateral movement step and record the exact commands and resulting access

Map each AD technique used to a detection opportunity a defender could implement

Attempt at least one domain privilege escalation path and document the outcome whether or not it succeeds

Test the practice web app for injection, broken access control, and authentication flaws

Test for cross-site scripting and file upload weaknesses and record payloads and results

Prioritize web findings by exploitability and business impact rather than scanner severity alone

Write remediation guidance for each web finding that a developer could act on directly

Set up a wireless lab with a monitor-mode adapter and capture a handshake from your own access point

Crack the captured handshake and document the wordlist and time required

Identify and explain at least three wireless attack categories and the controls that mitigate each

Review all prior findings and consolidate them into a single severity-ranked register

Re-test two earlier findings after applying the documented fix to confirm remediation

Assemble a full penetration test report: executive summary, scope, methodology, findings, and appendices

Write an executive summary in plain language with no jargon and a clear risk narrative

Apply a consistent severity rating method and justify each rating in one sentence

Perform a peer-style self-review against a report quality checklist and fix every gap

Prepare a ten-minute verbal debrief script summarizing the top three risks and recommended actions