CompTIA PenTest+ (PT0-003)

An OSINT tool used to gather public information (emails, subdomains, hostnames, employee names, banners, open ports) from various public sources for a given target domain or company name.

• Automates collection of email addresses and subdomains.
• Leverages search engines (Google, Bing, Baidu), PGP key servers, LinkedIn, etc.
• Useful for initial reconnaissance to build a target profile.

A security flaw in a web application that allows an attacker to upload malicious files (e.g., web shells, scripts) to the server, potentially leading to remote code execution, defacement, or other compromise.

• Occurs due to insufficient validation of file types, content, or size.
• Can be exploited by uploading files with double extensions (e.g., .php.jpg) or content type manipulation.
• Often leads to Remote Code Execution (RCE) if the uploaded file is executed by the server.

Staged payloads send a small stager that downloads the full payload afterward (slash notation), while stageless payloads deliver the entire payload in a single package (underscore notation).

• Staged: windows/meterpreter/reverse_tcp
• Stageless: windows/meterpreter_reverse_tcp
• Stageless payloads are larger but more firewall-resilient

A targeted brute-force technique that defines the character set for each position in a password based on a known or suspected pattern, drastically reducing keyspace versus full brute force.

• ?u = uppercase, ?l = lowercase, ?d = digit, ?s = special
• Keyspace = product of charset sizes per position
• Far more efficient than full charset brute force when policy/pattern is known

A half-open TCP scan that sends SYN packets and resets the connection before completion, providing fast, low-footprint port discovery.

• Also called a 'half-open' scan
• Requires raw socket privileges (root/admin)
• Default scan type when running Nmap with elevated privileges

Publicly auditable logs that record all SSL/TLS certificates issued by Certificate Authorities. They are a valuable resource for passive subdomain enumeration.

• Maintains a public record of all issued SSL/TLS certificates.
• Can reveal subdomains associated with an organization's primary domain.
• A passive reconnaissance technique as it doesn't interact with the target.

An attack exploiting a design flaw in Wi-Fi Protected Setup (WPS) that allows for the brute-forcing of the 8-digit PIN in two halves, significantly reducing the time required to recover the WPA2-PSK passphrase.

• Exploits a weak authentication mechanism in WPS.
• Typically uses the tool Reaver or similar.
• Can recover the WPA2-PSK passphrase within hours, even with strong passwords.

A contract provision where one party agrees to compensate the other for losses, damages, or legal costs arising from claims related to actions performed under the agreement.

• Often shields the testing firm from third-party lawsuits stemming from authorized testing
• Differs from limitation of liability, which caps the tester's own exposure
• Commonly paired with authorization letters and NDAs in the SOW/MSA

A tool designed to search through Git repositories, commit history, and other data sources to find high-entropy strings, patterns, or sensitive data like API keys, credentials, and configuration files.

• Scans Git repositories (GitHub, GitLab, Bitbucket, local).
• Identifies sensitive data based on entropy and predefined patterns.
• Useful for discovering accidentally exposed secrets in code.

The process of discovering and assessing cloud object storage (e.g., AWS S3, Azure Blob) for public exposure or misconfigured access controls.

• Tools: S3Scanner, Bucket Finder, ScoutSuite, CloudBrute
• Checks bucket naming, DNS entries, and ACL/policy settings
• Common finding: publicly readable/writable buckets exposing sensitive data

An nmap scan mode that identifies live hosts on a network using ICMP, ARP, or TCP/UDP probes without scanning any ports.

• -sn = 'no port scan', formerly called -sP
• Useful for fast network sweeps before deeper scans
• Falls back to ARP requests on local subnets for speed

A design flaw in WPS where the 8-digit PIN is verified in two separate halves, allowing attackers like reaver to brute-force the PIN in roughly 11,000 attempts instead of 100 million.

• 8th PIN digit is a checksum, leaving 7 unknown digits
• AP validates first 4 digits and last 3 digits separately
• Reduces brute-force keyspace from 10^8 to about 11,000 combinations

A technique to maintain persistence on a compromised system by forcing a legitimate process to load and execute a malicious Dynamic Link Library (DLL).

• Malicious code runs within a trusted process's memory space.
• Difficult to detect as it mimics legitimate system behavior.
• Can re-establish command and control (C2) even if parent process terminates.

A web vulnerability that allows an attacker to execute arbitrary operating system commands on the server running a web application, typically by injecting commands into user-supplied input.

• Occurs when an application passes unsanitized user input to a system shell.
• Attackers can use various shell metacharacters (e.g., ;, &&, ||, |, `) to chain commands.
• Can lead to full system compromise if executed with sufficient privileges.

Using Hashcat, a powerful password cracking utility, to break NTLM (NT LAN Manager) password hashes, typically through dictionary attacks, brute-force, or hybrid attacks.

• NTLM hashes are commonly found in Windows environments.
• Hashcat mode '1000' is used for NTLM hashes.
• The '-a 0' flag specifies a dictionary attack.

Exploiting legitimate binaries with the SUID bit set to gain elevated privileges, typically by executing a shell or another privileged command.

• SUID bit allows a program to run with the permissions of its owner.
• If a root-owned SUID binary can execute arbitrary commands, it can lead to privilege escalation.
• Common SUID binaries to check include 'find', 'nmap', 'vi', 'more', 'less'.

The first phase of PTES where scope, objectives, legal agreements, and RoE are established between tester and client.

• Occurs before any technical testing
• Includes defining scope and success criteria
• Sets legal groundwork (contracts, NDA, RoE)

A web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially leading to unauthorized data access, modification, or deletion.

• Occurs when user-supplied input is insecurely incorporated into SQL queries.
• Can be detected by injecting special characters (e.g., single quote, double dash).
• Blind SQLi relies on timing or boolean responses; error-based SQLi returns database errors.

A portable RFID research tool capable of reading, sniffing, and cloning low- and high-frequency proximity card credentials.

• Supports both 125kHz (low-freq) and 13.56MHz (high-freq) cards
• Used in physical penetration tests to clone employee badges
• Requires proximity to the target card to capture signal

Hashcat supports multiple attack modes (-a) that define how candidate passwords are generated to match hashes, ranging from dictionary-based to brute-force approaches.

• -a 0: straight dictionary attack
• -a 3: brute-force/mask attack
• -a 0 -r applies rule files to mutate dictionary words efficiently

Burp Intruder is a powerful tool within Burp Suite used for automating customized attacks against web applications, such as brute-force attacks, dictionary attacks, and username enumeration.

• Automates repetitive requests
• Supports various attack types (e.g., Sniper, Battering Ram)
• Analyzes response differences for enumeration/vulnerability discovery

Deploying a malicious Web Application Archive (WAR) file to a vulnerable Apache Tomcat server to maintain access or establish a backdoor.

• Requires access to Tomcat Manager or a vulnerability to upload WAR files.
• A WAR file can contain a web shell or a reverse shell payload.
• Metasploit provides modules for automating this process.

An injection technique that appends a UNION SELECT statement to an existing query so attacker-chosen data is returned in the application's output.

• Requires matching the number of columns in the original query
• NULL is often used as a placeholder for unknown data types
• Effective when application output is directly visible to the tester

A Kerberos attack where an adversary uses the krbtgt account's NTLM hash to forge a Ticket Granting Ticket, granting persistent, domain-wide access that survives password resets.

• Requires the krbtgt hash, often obtained via DCSync
• Grants access to any service in the domain as any user
• Remediated by resetting the krbtgt password twice