13%
Engagement Management
This domain establishes authorization, scope, communication, and reporting expectations. It also tests whether you can connect technical findings to business risk and remediation without exceeding the rules of engagement.
1.1 Planning, scope, and rules of engagement
Before testing begins, the tester must know what is authorized, when testing may occur, which techniques are prohibited, and who can approve a change. PT0-003 scenarios frequently reward scope discipline over technical opportunity.
- Statement of work, master service agreement, NDA, and authorization letter
- In-scope and out-of-scope assets, testing windows, stop conditions, and escalation contacts
- Black-box, gray-box, white-box, internal, external, and assumed-breach approaches
1.2 Legal, ethical, and compliance boundaries
A technically possible test may still be unlawful or contractually prohibited. Know how data residency, privacy, third-party hosting, regulated data, and evidence handling influence the engagement plan.
- Written permission, jurisdiction, third-party authorization, and cloud-provider policies
- Data minimization, chain of custody, secure evidence storage, and retention
- PCI DSS, HIPAA, GDPR, contractual requirements, and professional ethics
1.3 Communication, reporting, and remediation
PT0-003 integrates reporting into the engagement rather than treating it as a final isolated domain. Findings should be reproducible, prioritized, tied to business impact, and followed by remediation validation.
- Executive summary versus technical finding detail
- Evidence, affected assets, attack path, severity, likelihood, and business impact
- Remediation guidance, compensating controls, retesting, lessons learned, and final sign-off
Practice labs
Use only systems you own or have explicit authorization to test.
21%
Reconnaissance and Enumeration
Reconnaissance builds the target picture; enumeration turns that picture into testable services, identities, technologies, and trust relationships. The exam expects both passive and active methods plus disciplined interpretation of results.
2.1 Passive reconnaissance and OSINT
Passive collection reduces target interaction and can reveal domains, employees, cloud assets, exposed documents, technology choices, and leaked credentials. Treat source reliability and collection timestamps as part of the evidence.
- WHOIS/RDAP, DNS history, certificate transparency, search operators, code repositories, and metadata
- Social media, organizational charts, breach exposure, job postings, and supplier relationships
- Attack-surface discovery with Shodan, Censys, Amass, Subfinder, and theHarvester
2.2 Active discovery and service enumeration
Active techniques interact with the target and must remain inside approved rate, time, and protocol boundaries. The goal is not just open ports; it is accurate service, version, configuration, and trust information.
- Host discovery, TCP/UDP scanning, banner grabbing, service fingerprinting, and OS detection
- DNS, SMB, SNMP, LDAP, Kerberos, SMTP, database, VPN, and remote-management enumeration
- Nmap scripting, packet capture, proxying, and custom Python, Bash, or PowerShell modifications
2.3 Web, API, cloud, wireless, and identity enumeration
Modern assessments cross traditional network boundaries. Enumerate application routes, API schemas, cloud identities, storage, wireless networks, and directory relationships without assuming that one asset inventory is complete.
- Content discovery, virtual hosts, API endpoints, parameters, frameworks, and authentication flows
- Cloud tenants, IAM roles, public storage, serverless endpoints, containers, and exposed secrets
- Wireless SSIDs and security modes, Active Directory objects, trusts, group membership, and attack paths
Practice labs
Use only systems you own or have explicit authorization to test.
17%
Vulnerability Discovery and Analysis
This domain separates raw scanner output from defensible findings. You must select an appropriate discovery method, validate results, account for compensating controls, and prioritize what is most likely to create meaningful impact.
3.1 Discovery strategy and scanner operation
Credentialed and uncredentialed scans answer different questions, and scan safety matters in fragile environments. Tune scope, checks, timing, authentication, and performance before trusting the output.
- Network, web, cloud, container, wireless, application, and configuration assessment methods
- Credentialed versus uncredentialed scans, safe checks, scan windows, throttling, and exclusions
- Nessus, OpenVAS/Greenbone, Nuclei, Nikto, Burp Suite, ZAP, and cloud-native assessment tools
3.2 Analysis, validation, and false positives
A scanner finding becomes useful only after the tester confirms exposure, version, configuration, reachability, and exploit preconditions. Manual validation prevents false positives and can also uncover false negatives.
- CVE/CWE mapping, vendor advisories, exploit maturity, patch level, and configuration evidence
- Manual request replay, banner verification, authenticated checks, and proof-of-concept validation
- False positives, false negatives, environmental constraints, and compensating controls
3.3 Risk ranking and attack-path analysis
CVSS is an input, not the final business decision. Combine technical severity with asset value, exposure, privilege gained, data sensitivity, and how findings chain together.
- CVSS base and environmental considerations
- Exploitability, attack complexity, privileges, user interaction, scope, and business impact
- Attack-path chaining, crown-jewel proximity, remediation priority, and clear evidence notes
Practice labs
Use only systems you own or have explicit authorization to test.
35%
Attacks and Exploits
This is the largest PT0-003 domain. Focus on selecting an attack that matches validated conditions, understanding the expected result and risk, and stopping when scope or stability constraints require it.
4.1 Network, host, and identity attacks
Network and host exploitation often depends on weak authentication, exposed services, unsafe defaults, or missing patches. Be able to distinguish credential attacks, relay, service exploitation, privilege escalation, and attacks on directory trust.
- Password spraying, credential stuffing, offline cracking, pass-the-hash, Kerberoasting, and relay concepts
- Service exploits, misconfigurations, insecure permissions, scheduled tasks, libraries, and local privilege escalation
- Active Directory and cloud identity abuse, token/session attacks, and authorization weaknesses
4.2 Web, API, cloud, and container attacks
Application testing should follow data and trust boundaries rather than a memorized list. Trace input through validation, authorization, storage, execution, and downstream services.
- Injection, XSS, request forgery, path traversal, file inclusion/upload, deserialization, and command execution
- Broken object-level authorization, token flaws, rate-limit bypass, mass assignment, and API inventory gaps
- Cloud IAM mistakes, exposed storage, metadata services, serverless permissions, container escape concepts, and secret leakage
4.3 Wireless and WPA3-specific testing
Do not treat WPA3 as a renamed WPA2. SAE resists traditional offline dictionary cracking, so testing shifts toward configuration, transition-mode downgrade exposure, implementation flaws, weak enrollment, Evil Twin behavior, and enterprise certificate validation.
- WPA3-Personal SAE behavior, transition mode, downgrade risk, Dragonblood-class implementation history, and password policy
- WPA3-Enterprise/EAP certificate validation, rogue access points, Evil Twin scenarios, and credential capture controls
- WPS exposure, deauthentication limits, protected management frames, client isolation, guest segmentation, and wireless scope
4.4 AI and machine-learning security testing
PT0-003 explicitly introduces attacks against AI systems. Test the application around the model as well as the model interaction: authorization, data flow, tools, retrieval sources, output handling, and human approval boundaries.
- Direct and indirect prompt injection, insecure output handling, excessive agency, and sensitive-information disclosure
- Model manipulation, data or retrieval poisoning, model extraction concepts, denial of wallet, and unsafe plugin/tool access
- Document prompts and model versions, validate AI-generated findings manually, and never let an assistant expand scope or execute unreviewed actions
Practice labs
Use only systems you own or have explicit authorization to test.
14%
Post-exploitation and Lateral Movement
After initial access, the objective is to demonstrate realistic impact without creating uncontrolled harm. PT0-003 emphasizes situational awareness, privilege, persistence, pivoting, lateral movement, evidence, cleanup, and communication.
5.1 Situational awareness, privilege, and persistence
Re-enumerate from the new host before acting. Identify identity, privileges, network position, security controls, available credentials, and approved persistence limits.
- Local and domain context, processes, services, sessions, routes, security products, and accessible data
- Linux and Windows privilege-escalation paths, token and credential material, and least-disruptive proof
- Persistence mechanisms only when explicitly authorized, with timestamps and removal instructions
5.2 Pivoting and lateral movement
A foothold may expose networks unavailable from the original test host. Choose tunneling and movement techniques that fit the protocol, identity, segmentation, logging, and rules of engagement.
- Port forwarding, SOCKS proxies, VPN-style tunnels, routing, and double-pivot concepts
- Remote services, administrative shares, SSH, WinRM, RDP, WMI, Kerberos, and cloud session reuse
- BloodHound attack paths, segmentation validation, credential hygiene, and stop conditions
5.3 Modern command-and-control tooling
Know the architecture and operational role of C2 frameworks, not just names. Cobalt Strike remains relevant; current open-source platforms such as Sliver, Havoc, and Mythic better represent modern team servers, agents, profiles, and collaborative operations than relying on Empire alone.
- Cobalt Strike for licensed commercial team operations and malleable profiles
- Sliver for cross-platform open-source agents and multiplayer operation
- Havoc and Mythic for extensible team-server workflows, agents, tasking, and operational logging
5.4 Evidence, cleanup, and final communication
Professional post-exploitation ends with controlled evidence and restoration. Remove artifacts according to the agreed plan, preserve proof, disclose unexpected impact immediately, and support remediation and retesting.
- Screenshots, commands, timestamps, hashes, affected identities, and attack-path narrative
- Remove accounts, payloads, persistence, tunnels, test data, and configuration changes
- Emergency notifications, deconfliction, remediation verification, retest results, and residual-risk statements
Practice labs
Use only systems you own or have explicit authorization to test.