CompTIA PenTest+ (PT0-003) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 500-question exam simulator; nothing is taken away from the free course to make room for it.

41written lessons

62hands-on labs

73hours of lab work

21audio episodes

500practice questions

Start with lesson 1 — What a penetration test actually is, and is not Exam simulator

Jump to a domain: 1. Engagement Management · 2. Reconnaissance and Enumeration · 3. Vulnerability Discovery and Analysis · 4. Attacks and Exploits · 5. Post-Exploitation and Lateral Movement

What the exam weighs

Domain	Share of the exam	Lessons here
1. Engagement Management	13%	5
2. Reconnaissance and Enumeration	21%	8
3. Vulnerability Discovery and Analysis	17%	7
4. Attacks and Exploits	35%	14
5. Post-Exploitation and Lateral Movement	14%	6

The curriculum

1. Engagement Management 13% of the exam

01 What a penetration test actually is, and is not objective 1.1 part single
- Classify six engagements before you scope any of them short · 45 min
02 Rules of engagement, testing windows and target selection objective 1.1 part single
- Build a rules-of-engagement package and stress it applied · 90 min
- Write a scope a stranger could execute short · 45 min
03 Authorisation, the law, and when you are obliged to report objective 1.2 part single
- Draft an authorisation letter and an escalation policy applied · 90 min
04 Peer review, escalation paths and articulating risk objective 1.3 part single
- Route findings and translate one into a decision applied · 75 min
05 Writing the penetration test report objective 1.4 part single
- Assemble a report and write the summary an executive acts on applied · 90 min
- Run the whole of engagement management on one brief capstone · 150 min
- Write one finding four ways and keep the one that survives short · 50 min

2. Reconnaissance and Enumeration 21% of the exam

01 Passive reconnaissance and OSINT objective 2.1 part single
- Footprint a domain from records alone, with provenance short · 50 min
02 Active reconnaissance, sniffing and protocol scanning objective 2.1 part single
- Map a lab segment and reconcile it with your own log applied · 80 min
- Capture what a host volunteers before you authenticate short · 50 min
03 DNS enumeration objective 2.2 part single
- Enumerate a zone you host, and try to transfer it short · 50 min
04 Service discovery and port scanning objective 2.2 part single
- Scan a host you built and account for every difference short · 50 min
05 Directory and web content enumeration objective 2.2 part single
- Merge a curated scan and your own wordlist into one surface applied · 80 min
- Enumerate a web root you filled, and read the status codes right short · 50 min
06 Nmap in depth objective 2.3 part single
- Read a scripting-engine script before you run it applied · 75 min
- Choose a scan type on purpose and measure what timing costs short · 50 min
07 Wireshark and Shodan for the tester objective 2.3 part single
- Prove encryption hides content but not the conversation short · 50 min
08 Customising recon scripts in Python, PowerShell and Bash objective 2.4 part single
- Make a recon script refuse targets outside a scope file applied · 80 min
- Run reconnaissance end to end against your own lab, scope-enforced capstone · 150 min
- Parse tool output and make an empty parse loud short · 50 min

3. Vulnerability Discovery and Analysis 17% of the exam

01 What a vulnerability scan sees, and what it misses objective 3.1 part single
- Plant a logic flaw a scanner cannot see short · 50 min
02 Authenticated and unauthenticated scanning objective 3.1 part single
- Test a segmentation claim from inside and outside applied · 80 min
- Scan one host twice and diff what credentials reveal short · 50 min
03 SAST and DAST: testing the code and the running application objective 3.1 part single
- Run SAST and DAST on your own app and map the blind spots short · 55 min
04 Validating findings and killing false positives objective 3.2 part single
- Triage a scanner export down to findings you can defend applied · 85 min
- Disprove a scanner finding before it reaches a report short · 50 min
05 When the scan is wrong: troubleshooting configuration objective 3.2 part single
- Break a scan on purpose and catch the silent failure short · 50 min
06 Nessus and OpenVAS objective 3.3 part single
- Build a merged, deduplicated finding pipeline applied · 85 min
- Run two scanners on one host and diff their answers short · 55 min
07 Nikto and web scanning objective 3.3 part single
- Run vulnerability discovery end to end and defend every finding capstone · 150 min
- Confirm every Nikto hit by hand against a soft-404 server short · 50 min

4. Attacks and Exploits 35% of the exam

01 VLAN hopping and why segmentation fails objective 4.1 part single
- Bridge two VLANs by a native-VLAN mistake, then close it short · 55 min
02 On-path attacks objective 4.1 part single
- Sit in the path between two machines you own short · 55 min
03 Exploiting an exposed service objective 4.1 part single
- Take a version to a proven finding, and keep the cleanup list applied · 90 min
- Exploit a weak service you built, and watch the wire and logs short · 60 min
04 Brute force, password spraying and credential stuffing objective 4.2 part single
- Run all three guessing attacks against accounts you created short · 55 min
05 Pass-the-hash and credential replay objective 4.2 part single
- Chain a foothold into lateral reach, then break the chain applied · 90 min
- Replay a credential between two machines you built short · 60 min
06 Privilege escalation on Linux objective 4.3 part single
- Enumerate systematically and rank every escalation path applied · 85 min
- Escalate on a Linux VM you weakened, by enumeration short · 60 min
07 Privilege escalation on Windows objective 4.3 part single
- Escalate on a Windows VM you weakened, and harden it short · 60 min
08 Process injection and credential dumping objective 4.3 part single
- Dump credentials from a VM you own and see what EDR sees short · 60 min
09 SQL injection objective 4.4 part single
- Take an injection from signal to a report-ready finding applied · 85 min
- Prove SQL injection on your own app without destroying data short · 60 min
10 Cross-site scripting objective 4.4 part single
- Prove XSS impact on your own app without harming a user short · 55 min
11 Directory traversal and file inclusion objective 4.4 part single
- Read a file you should not, on an app you built, then close it short · 55 min
12 Container escape and cloud metadata services objective 4.5 part single
- Escape a container you ran, and reach a metadata service you host short · 60 min
13 IAM misconfiguration in the cloud objective 4.5 part single
- Map a cloud attack path and write the least-privilege fix applied · 85 min
- Enumerate your own tenant's permissions and find the escalation short · 55 min
14 AI attacks: prompt injection and model manipulation, explained objective 4.6 part single
- Assess an AI feature's exposure on paper applied · 75 min
- Assess a whole application's attack surface, on your own lab and on paper capstone · 150 min

5. Post-Exploitation and Lateral Movement 14% of the exam

01 Establishing persistence objective 5.1 part single
- Place persistence on a VM you own, and record every mechanism short · 55 min
02 Lateral movement objective 5.1 part single
- Move between two lab hosts and log the route short · 55 min
03 Pivoting and tunnelling objective 5.1 part single
- Chain footholds across three lab segments, in scope throughout applied · 90 min
- Reach a segment only the compromised host can see short · 55 min
04 Cleaning up: restoring everything you changed objective 5.1 part single
- Restore a lab host from your cleanup list and prove it short · 50 min
05 Writing the attack narrative objective 5.2 part single
- Write the attack narrative from your own engagement log short · 55 min
06 Remediation recommendations that get acted on objective 5.2 part single
- Negotiate one finding to a dated, owned commitment applied · 80 min
- Deliver a full engagement from foothold to signed-off report capstone · 180 min
- Write remediation at the cause, sequenced and affordable short · 50 min

Supplementary not examined — background reading

01 Building a lab you own and cannot accidentally escape part single
- Prove your lab cannot reach anything you do not own short · 50 min

The exam simulator

500 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

21 of the 41 lessons have an audio episode so far, and each plays in the lesson itself — there is nothing extra to sign up for.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.