FREE CompTIA PenTest+ Study Guide 2026 (PT0-003)

This free CompTIA PenTest+ study guide covers every domain the current PT0-003 exam tests, organized to CompTIA’s official exam objectives.^[2] PenTest+ is CompTIA’s hands-on penetration testing certification — it validates the skills to plan and scope an engagement, perform reconnaissance, find and exploit vulnerabilities, move through a network, and report findings with clear remediation.

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, crawlable diagrams, flashcards, and practice questions, so you learn by doing — not just reading.

The PenTest+ PT0-003 exam has five domains, and we teach each one as its own module, leading with the heaviest-weighted content. Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This guide is a high-yield overview mapped to the official objectives — not a full offensive-security textbook.

CompTIA PenTest+ is one of the 14 CompTIA certifications — explore our CompTIA study guides to compare and prep across the whole family.

PenTest+ (PT0-003) Exam Snapshot

One domain dominates. Attacks & Exploits (35%) is over a third of the exam by itself — together with Reconnaissance & Enumeration (21%) it is more than half of your score.^[2] Study by weight:

CompTIA numbers the domains 1.0 through 5.0 (Engagement Management is officially Domain 1.0). We teach them by exam weight — but the work itself follows a natural order, so we start the guide with Engagement Management (scoping and authorization come first in any real test), then move through recon, vulnerability analysis, exploitation, and post-exploitation. The whole methodology looks like this:

Module 1 · Engagement Management

Domain 1.0 — 13% of the exam. Before a single packet is sent, the engagement has to be scoped, authorized, and governed. This domain is the “business and legal” side of penetration testing — it is less technical but absolutely tested, and getting it wrong can be illegal.

1.1 Scoping & Rules of Engagement

Every engagement begins with Scope — the explicit boundary of which IP ranges, domains, applications, and facilities are in or out of bounds. The Rules of Engagement (RoE) then define exactly what the tester may do: timing windows, allowed techniques (is Social engineering or denial of service permitted?), and a communication and escalation plan with a defined stop point (a condition that halts testing immediately).^[3]

Engagements are also classified by how much the tester knows: a black-box test gives no information (the realistic outsider), a white-box test gives full information (the most thorough), and a gray-box test sits in between with limited information such as a standard user account.

1.2 Legal, Compliance & Ethics

Penetration testing lives or dies on permission. Beyond the client’s sign-off, you must respect third-party ownership — a hosting provider or cloud platform may own the underlying infrastructure, so the client cannot authorize you to attack it without the provider’s rules and permission. Compliance-driven tests (PCI DSS, HIPAA) have their scope and required checks dictated by the regulation, not just the client.

Industry methodologies give the engagement structure: PTES (seven phases), NIST SP 800-115, and OSSTMM. They all share the same plan → test → report shape, and MITRE ATT&CK provides a common language for the adversary techniques you emulate.^[6]

1.3 Reporting & Remediation

The deliverable that pays the bill is the report. A strong report serves two audiences: an executive summary for leadership (business risk, in plain language) and detailed technical findings for the staff who will fix them — each finding with evidence, a severity rating, and a clear, prioritized remediation recommendation.^[3] Findings are prioritized by risk (severity combined with exploitability and business impact), not by CVSS score alone.

Module 2 · Reconnaissance & Enumeration

Domain 2.0 — 21% of the exam, the second-largest domain. You can’t attack what you haven’t found. Reconnaissance builds a map of the target’s attack surface, and enumeration extracts the detail — users, shares, versions — that the exploitation phase depends on.

2.1 Passive Recon & OSINT

Passive reconnaissance gathers information without ever touching the target — so the target sees nothing. This is OSINT (Open-Source Intelligence): WHOIS records, DNS lookups, search engines, certificate transparency logs, social media, job postings, and leaked credentials. It feeds both technical targeting (subdomains, IPs) and social engineering (employee names and email formats).^[3]

2.2 Active Scanning & Enumeration

Active reconnaissance directly probes the target — and the workhorse is Nmap. A SYN scan (-sS) is fast and stealthy; -sV identifies service versions; -O guesses the OS; and the Nmap Scripting Engine (NSE) automates discovery and even vulnerability checks. Banner grabbing and Fingerprinting then pin down the exact software so attacks can be matched to known weaknesses.

Enumeration goes deeper into discovered services: SMB shares and users (enum4linux), SNMP (often with the default community string public), LDAP/Active Directory, and SMTP user enumeration. Wireshark and tcpdump capture traffic — sometimes revealing credentials in clear text.

2.3 Reconnaissance Tooling

PT0-003 references more than 80 tools, and the performance-based questions test whether you know which tool for which job. For recon and enumeration, group them by purpose: OSINT collection, network scanning, web/content discovery, and traffic capture.

Module 3 · Vulnerability Discovery & Analysis

Domain 3.0 — 17% of the exam. Between finding the attack surface and attacking it, you identify weaknesses and decide which are real and worth exploiting. This domain is about scanning, then the human judgment of validating and prioritizing what the scanner reports.

3.1 Vulnerability Scanning

A Vulnerability scan automatically checks systems against a database of known weaknesses to produce a prioritized findings list — but it does not exploit anything (that’s what makes it different from a penetration test). Network scanners include Nessus and OpenVAS; web scanners include Nikto, Wapiti, OWASP ZAP, and WPScan; and Fuzzing sends malformed input to provoke crashes and bugs.^[5]

A credentialed scan logs in to inspect patch levels and configuration from the inside — far more accurate, with fewer false positives, than an external non-credentialed scan. Always tune scan intensity for fragile systems (ICS/SCADA, legacy hosts) to avoid causing an outage.

3.2 Analyzing & Validating Results

Scanners are noisy. A False positive is a flagged vulnerability that isn’t real or exploitable; a False negative is a real one the scanner missed. Validation — manually confirming a finding is real and exploitable — is what separates a credible report from a raw scan dump. Look up findings by CVE in the NVD and check Exploit-DB (with searchsploit) for a working exploit.

Prioritize with CVSS (0.0–10.0 severity) — but remember that priority is not the same as severity: the final order weighs exploitability and business context, too.^[7] Automated scans also miss business-logic flaws (e.g., skipping a payment step), which only manual testing finds.

Module 4 · Attacks & Exploits

Domain 4.0 — 35% of the exam, by far the single largest domain. This is the heart of PenTest+: actually exploiting weaknesses across five attack surfaces — network/host, web application, wireless, cloud, and the human (social engineering). Spend the most time here.

4.1 Network & Host Attacks

On the wire, the classic is the On-path attack (formerly man-in-the-middle): an attacker relays or alters traffic between two parties, often via ARP poisoning or a rogue access point. Other high-yield attacks: DNS poisoning, replay, SMB relay (mitigated by SMB signing), and LLMNR/NBT-NS poisoning with Responder to capture NTLM hashes. Host-level flaws include the Buffer overflow (overwriting memory to run code) and the Zero-day (no patch exists yet).

4.2 Web Application Attacks

Web apps are a huge part of the exam, anchored by the OWASP Top 10.^[4] The headliners: SQL injection (input becomes database commands — fix with parameterized queries), Cross-site scripting (script runs in another user’s browser — fix with output encoding and CSP), Cross-site request forgery (forged state-changing request — fix with anti-CSRF tokens), and Server-side request forgery (the server is tricked into requesting internal resources, often a cloud metadata endpoint). Watch also for IDOR/broken access control, command injection, and directory traversal.

4.3 Wireless, Cloud & Social Engineering

Wireless: capture the WPA/WPA2 handshake (airodump-ng) and crack it offline (aircrack-ng or hashcat), stand up an Evil twin rogue AP, or run a deauth attack to force reconnections. WPA3’s SAE resists the offline cracking that works on WPA2-PSK.

Cloud: the big wins are abusing the instance metadata service (e.g., via SSRF) to steal temporary credentials, misconfigured public storage buckets, and over-permissive IAM that allows privilege escalation. Social engineering attacks the human with Phishing (and vishing, smishing, spear phishing, whaling), pretexting, tailgating, and USB drops — the Social-Engineer Toolkit (SET) helps build the lures.^[8]

4.4 Tools, Payloads & Password Attacks

Metasploit is the central exploitation framework: it delivers an Exploit and a Payload, the most popular being Meterpreter. A Reverse shell connects from the victim back to the attacker (beating inbound firewalls); a bind shell listens on the victim. Password attacks split into online (Hydra/Medusa against live services, plus password spraying and credential stuffing) and offline cracking of captured hashes (John the Ripper, Hashcat, defeated salting with rainbow tables).

Module 5 · Post-exploitation & Lateral Movement

Domain 5.0 — 14% of the exam. Initial access is just the Foothold. This domain is everything you do afterward to deepen and expand control — and, on an authorized test, how you clean up so the environment is returned to its original state.

5.1 Privilege Escalation & Persistence

Privilege escalation climbs from a low-privilege account to admin/root — vertically (more rights) or horizontally (another user). On Linux, look for SUID binaries (GTFOBins), weak sudo rules, and writable services; on Windows, look for unquoted service paths, weak permissions, and UAC-bypass paths.

Enumeration scripts (linPEAS/winPEAS) surface these automatically. Persistence then keeps your access across reboots — scheduled tasks, services, Run keys (Windows), cron jobs and SSH keys (Linux), or a backdoor account.

5.2 Lateral Movement & Pivoting

Lateral movement uses one compromised host to reach others. The Windows/AD techniques are high-yield: Pass-the-hash (authenticate with an NTLM hash directly), pass-the-ticket and Kerberoasting (Kerberos abuse), and remote execution with PsExec, WMI, or RDP.

BloodHound maps Active Directory to find the shortest path to Domain Admin. Pivoting then routes your traffic through a compromised host (a SOCKS proxy via ssh -D, ProxyChains, or chisel) to reach networks you can’t touch directly.

5.3 Credential Harvesting & Cleanup

On Windows, Mimikatz (and Impacket’s secretsdump.py) dumps plaintext passwords, hashes, and Kerberos tickets from LSASS, the SAM, or a domain controller’s NTDS.dit — fuel for more lateral movement. Finally, the ethical difference that PenTest+ stresses: a real attacker clears logs, but an authorized tester documents actions and timestamps and then performs cleanup — removing tools, payloads, accounts, and persistence to restore the environment.

How to Use This PenTest+ Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

• Study by weight. Attacks & Exploits (35%) and Reconnaissance & Enumeration (21%) are over half the exam — invest there first, then Vulnerability Analysis, Post-exploitation, and Engagement Management.
• Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
• Take every checkpoint. The end-of-module quizzes show you exactly which domains need another pass.
• Practice the PBQs in a lab. Performance-based questions reward hands-on skill — build a home lab and practice with Nmap, Metasploit, and Burp Suite against intentionally vulnerable targets.
• Drill the weak domain. Send your weak area into the flashcards and a practice test until the score climbs comfortably above 750.

PenTest+ Glossary

The high-yield PenTest+ terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

Active reconnaissance

Directly interacting with the target — port scanning, banner grabbing, enumeration. More detail, but detectable.

Authorization

Written, signed permission from someone with authority over the target, proving the testing is legal and approved.

Banner grabbing

Reading a service's response banner to reveal the software and version, identifying likely vulnerabilities.

Black-box testing

An unknown-environment test where the tester is given no prior internal information — simulates an external attacker.

BloodHound

A tool that maps Active Directory relationships to find the shortest attack paths to Domain Admin.

Buffer overflow

Writing more data than a buffer holds, overwriting adjacent memory to redirect execution to attacker code.

Bug bounty

An ongoing program that pays external researchers for responsibly disclosed vulnerabilities, within defined scope.

Burp Suite

An intercepting web proxy used to capture, modify, and replay HTTP/S traffic and scan web apps for flaws.

Cross-site request forgery

Tricking an authenticated user's browser into sending an unwanted state-changing request; fixed with anti-CSRF tokens.

Cross-site scripting

Injecting script into a trusted site that runs in another user's browser (stored, reflected, or DOM-based).

CVE

Common Vulnerabilities and Exposures — a public catalog assigning a unique ID to each known, disclosed vulnerability.

CVSS

Common Vulnerability Scoring System — a 0.0–10.0 open standard (maintained by FIRST) rating vulnerability severity.

Enumeration

Actively extracting detailed information from discovered services — usernames, shares, software versions — to plan exploitation.

Evil twin

A fake Wi-Fi access point impersonating a legitimate SSID to capture credentials or perform on-path attacks.

Exploit

Code or a technique that takes advantage of a specific vulnerability to make a system behave unexpectedly.

False negative

A real vulnerability the scanner missed — the more dangerous error, addressed with manual testing.

False positive

A scanner flagging a vulnerability that doesn't exist or isn't exploitable; testers validate before reporting.

Fingerprinting

Analyzing responses to determine the exact OS or service version, so attacks can be matched to known weaknesses.

Foothold

The initial access point an attacker establishes on a target network, the base for escalation and movement.

Fuzzing

Sending malformed or unexpected input to an application to trigger crashes or behavior that reveal vulnerabilities.

Gray-box testing

A partially-known test where the tester is given limited information, such as a standard user account.

Kerberoasting

Requesting Kerberos service tickets for SPN accounts, then cracking them offline for the service password.

Lateral movement

Using a compromised host to reach and compromise other systems on the internal network.

Living off the land

Using built-in, trusted tools (PowerShell, WMI, certutil) instead of malware to evade detection.

Master Service Agreement

An overarching contract setting the general terms and conditions for an ongoing client relationship.

Metasploit

An exploitation framework bundling exploits, payloads, and post-exploitation modules to deliver and manage attacks.

Meterpreter

Metasploit's advanced, in-memory payload providing file access, privilege escalation, pivoting, and credential dumping.

Mimikatz

A Windows post-exploitation tool that dumps plaintext passwords, hashes, and Kerberos tickets from memory.

MITRE ATT&CK

A globally available knowledge base of real-world adversary tactics and techniques used to model and map attacks.

Nessus

A widely used commercial vulnerability scanner (Tenable) that checks hosts and apps against thousands of checks.

NIST SP 800-115

NIST's Technical Guide to Information Security Testing and Assessment, defining planning, discovery, attack, and reporting phases.

Nmap

The de facto network scanner — discovers hosts, ports, services, and OS fingerprints. Core to recon and enumeration.

Non-Disclosure Agreement

A legal agreement binding the tester to keep client data, findings, and vulnerabilities confidential.

On-path attack

An attacker secretly relaying or altering traffic between two parties (formerly 'man-in-the-middle').

OSINT

Open-Source Intelligence — collecting publicly available data (sites, social media, leaked credentials, records) to profile a target.

OWASP

Open Worldwide Application Security Project — a nonprofit producing the OWASP Top 10 and the Web Security Testing Guide.

Pass-the-hash

Authenticating to a Windows system using a captured NTLM hash directly, without cracking the plaintext password.

Passive reconnaissance

Gathering information without directly touching the target — OSINT, WHOIS, DNS, and search engines. Undetectable.

Payload

The code delivered and executed after a successful exploit — e.g., a reverse shell or a Meterpreter session.

Penetration test

An authorized, simulated attack on systems to find and exploit weaknesses before real attackers do, then report them with remediation.

Persistence

Establishing a way to keep access across reboots and credential changes — tasks, services, cron, keys, or accounts.

Phishing

A fraudulent message (usually email) that tricks the victim into revealing credentials or running malware.

Pivoting

Routing traffic through a compromised host to reach networks the attacker can't access directly.

Post-exploitation

Everything after initial access: privilege escalation, persistence, credential harvesting, and lateral movement.

Privilege escalation

Gaining higher rights than granted — vertical (to admin/root) or horizontal (to another user).

PTES

Penetration Testing Execution Standard — a methodology defining seven phases from pre-engagement through reporting.

Reverse shell

A shell that connects from the victim back to the attacker, bypassing inbound firewall rules.

Rules of Engagement

The agreed document defining what a tester may do — scope, timing, allowed techniques, and communication/escalation paths.

Scope

The explicit boundary of an engagement: which IP ranges, domains, applications, and facilities are in or out of bounds.

Server-side request forgery

Tricking a server into making requests to internal resources, often to reach cloud metadata endpoints.

Shodan

A search engine for Internet-connected devices that finds exposed servers, cameras, and ICS by their service banners.

Social engineering

Manipulating people into revealing information or taking actions that compromise security — the human attack vector.

SQL injection

Inserting malicious SQL into input so the database runs unintended commands; fixed with parameterized queries.

Statement of Work

The contract section defining the deliverables, timeline, and tasks of an engagement.

Validation

Manually confirming a scanner finding is real and exploitable before including it in the report.

Vulnerability scan

Automated checking against a database of known weaknesses to produce a prioritized findings list (no exploitation).

White-box testing

A known-environment test where the tester is given full information (source, architecture, credentials) for the most thorough assessment.

Wireshark

A GUI packet capture and protocol analyzer used to inspect traffic and extract clear-text credentials.

Zero-day

A vulnerability unknown to the vendor (no patch yet) that attackers can exploit.

PenTest+ Tools by Phase

One last reference — the tools PenTest+ tests, mapped to the phase you use them in. The performance-based questions test exactly this: which tool for which job.

PenTest+ Study Guide FAQ

References

1. 1.CompTIA. “CompTIA PenTest+ (PT0-003) Certification.” comptia.org. ↑
2. 2.CompTIA. “PenTest+ (PT0-003) Exam Objectives / Content Guide.” comptia.org. ↑
3. 3.National Institute of Standards and Technology. “SP 800-115, Technical Guide to Information Security Testing and Assessment.” csrc.nist.gov. ↑
4. 4.Open Worldwide Application Security Project. “OWASP Top 10.” owasp.org. ↑
5. 5.Open Worldwide Application Security Project. “Web Security Testing Guide (WSTG).” owasp.org. ↑
6. 6.The MITRE Corporation. “MITRE ATT&CK Knowledge Base.” attack.mitre.org. ↑
7. 7.Forum of Incident Response and Security Teams. “Common Vulnerability Scoring System (CVSS).” first.org. ↑
8. 8.Cybersecurity and Infrastructure Security Agency. “Recognize and Report Phishing.” cisa.gov. ↑
9. 101.National Institute of Standards and Technology (NIST). “Reconnaissance (CSRC Glossary).” csrc.nist.gov, accessed 19 June 2026. ↑
10. 102.National Institute of Standards and Technology (NIST). “Port Scanning (CSRC Glossary).” csrc.nist.gov, accessed 19 June 2026. ↑
11. 103.National Institute of Standards and Technology (NIST). “Vulnerability (CSRC Glossary).” csrc.nist.gov, accessed 19 June 2026. ↑
12. 104.Open Worldwide Application Security Project (OWASP). “SQL Injection.” owasp.org, accessed 19 June 2026. ↑
13. 105.Open Worldwide Application Security Project (OWASP). “Cross Site Scripting (XSS).” owasp.org, accessed 19 June 2026. ↑
14. 106.National Institute of Standards and Technology (NIST). “Privilege Escalation (CSRC Glossary).” csrc.nist.gov, accessed 19 June 2026. ↑
15. 107.National Institute of Standards and Technology (NIST). “Lateral Movement (CSRC Glossary).” csrc.nist.gov, accessed 19 June 2026. ↑

Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts