PNPT study plan
PNPT · Give each week a clear focus.
8 weeks · About 6 hours per week
Open-Source Intelligence (OSINT) reconnaissance & Professional reporting and live debrief
Map the five PNPT domains to a personal skill-gap list, scoring each domain 1-5 and flagging the two weakest subskills
Build a reusable OSINT collection workspace with folders for domains, certificates, breaches, and people, plus a findings log template
Enumerate a target organization's external footprint using certificate transparency logs, DNS records, and search-engine dorks, recording every asset in the findings log
Draft a one-page scope-and-rules-of-engagement summary you will reuse for your lab engagements
Your checkpoint
A 2-3 page OSINT footprint report on a public organization (assets, exposed services, leaked credentials found in public breach data, and 3 attack paths worth testing), formatted with a title page, findings table, and risk ratings
Open-Source Intelligence (OSINT) reconnaissance & External network penetration testing
Perform passive and active subdomain enumeration against a lab domain and reconcile results from at least three sources
Collect and parse publicly exposed metadata and documents to extract usernames and email naming conventions
Fingerprint external services and identify versions and known vulnerabilities without triggering IDS alerts
Convert OSINT findings into a prioritized external attack surface list with confidence levels
Your checkpoint
An external attack-surface inventory spreadsheet covering at least 25 discovered assets, each with discovery source, technology fingerprint, confidence rating, and a proposed verification step
External network penetration testing & Professional reporting and live debrief
Set up an isolated external-facing lab (firewalled attacker VM, target VMs, logging) and document the network diagram
Execute external reconnaissance-to-exploitation against the lab, capturing every command and screenshot as you go
Practice writing finding entries with description, evidence, impact, and remediation for at least three vulnerabilities
Test at least two egress-filtering bypass techniques against the lab perimeter and record which succeed
Your checkpoint
A draft external penetration test report for the lab containing an executive summary, scope, methodology, at least five findings with severity ratings, and remediation guidance
Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise) & Internal network penetration testing
Stand up an Active Directory lab with a domain controller, two member servers, and two workstations, and document the build
Enumerate the domain as an unauthenticated user and then as a low-privilege domain user, listing users, groups, SPNs, and shares
Execute credential-access techniques in the lab and record which defenses (AV, AMSI, logging) detect each one
Map the lab's attack paths from low-privilege user to Domain Admin using graph-based analysis
Your checkpoint
An AD lab build guide plus an attack-path diagram showing at least three distinct routes from a standard domain user to Domain Admin, annotated with the tool and detection risk for each hop
Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise) & Internal network penetration testing
Bypass antivirus and AMSI in the lab using at least three different techniques and note detection outcomes for each
Perform lateral movement across at least two hosts using different methods and capture the artifacts each leaves
Execute a full domain compromise chain from initial foothold to Domain Controller, writing the steps as a repeatable checklist
Test egress restriction bypass from an internal host and document which channels work
Your checkpoint
A step-by-step internal compromise playbook with commands, screenshots of each stage, and a detection-notes column explaining what a defender would see at every step
Internal network penetration testing & External network penetration testing
Run a full internal network penetration test against the lab from an assumed-breach starting point, including host discovery, service enumeration, and privilege escalation
Pivot through at least one compromised host to reach a segmented network segment
Collect and organize evidence for every finding into a single evidence folder with consistent naming
Time-box the engagement to simulate real constraints and log where you lost time
Your checkpoint
A complete internal penetration test report for the lab with at least eight findings, an attack narrative, evidence for each finding, and a remediation priority matrix
Professional reporting and live debrief & Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise)
Consolidate all prior lab reports into one professional deliverable with consistent formatting, numbering, and severity definitions
Write a two-page executive summary aimed at non-technical leadership that avoids jargon and quantifies business risk
Rehearse a 15-minute debrief presentation covering scope, methodology, top findings, and recommendations
Record yourself delivering the debrief and critique pacing, clarity, and handling of anticipated pushback
Your checkpoint
A presentation-ready deck plus speaker notes for a 15-minute client debrief, with a one-page handout summarizing the top five findings and recommended fixes
Open-Source Intelligence (OSINT) reconnaissance & Active Directory exploitation (A/V and egress bypassing, lateral and vertical movement, Domain Controller compromise) & External network penetration testing & Internal network penetration testing & Professional reporting and live debrief
Run a timed end-to-end mock engagement covering OSINT through domain compromise and reporting within a single sitting
Identify your three slowest steps and drill each one for 30 minutes
Review every lab report against a self-made quality checklist covering evidence, reproducibility, and remediation specificity
Deliver the mock debrief to a peer or recorded audience and incorporate at least three pieces of feedback
Your checkpoint
A final capstone package: one combined report spanning external and internal testing, an attack-path diagram, a 15-minute recorded debrief, and a personal remediation plan listing the three skills to keep practicing after the exam
Milestones
Week 2: You can produce a 25+ asset external inventory from a cold start in under three hours without reusing old notes
Week 4: Your AD lab is reproducible from your own build guide, and you can articulate three separate paths from user to Domain Admin
Week 6: You have completed a full internal test and written report under time pressure, and every finding has attached evidence
Week 8: You can deliver a coherent 15-minute debrief and hand over a report package that a stranger could follow and reproduce