CompTIA PenTest+ Certification (PT0-002日本語版) : PT0-002日本語 exam

Planning and Scoping - 15%

• Confidentiality of findings
• Known vs. unknown

- Budget
- Impact analysis and remediation timelines
- Disclaimers

• Point-in-time assessment
• Comprehensiveness

- Technical constraints
- Support resources

• WSDL/WADL
• SOAP project file
• SDK documentation
• Swagger document
• XSD
• Sample application requests
• Architectural diagrams

• SOW
• MSA
• NDA

- Environmental differences

• Export restrictions
• Local and national government restrictions
• Corporate policies

- Written authorization

• Obtain signature from proper signing authority
• ​Third-party provider authorization when necessary

• Goals-based/objectives-based
• Compliance-based
• Red team

- Special scoping considerations

• Premerger
• Supply chain

- Target selection

• Targets
  1. Internal
  - On-site vs. off-site
  2. External
  3. First-party vs. third-party hosted
  4. Physical
  5. Users
  6. SSIDs
  7. Applications
• Considerations
  1. White-listed vs. black-listed
  2. Security exceptions
  - IPS/WAF whitelist
  - NAC
  - Certificate pinning
  - Company’s policies

- Strategy

• Black box vs. white box vs. gray box

- Risk acceptance
- Tolerance to impact
- Scheduling
- Scope creep
- Threat actors

• Adversary tier
  1. APT
  2. Script kiddies
  3. Hacktivist
  4. Insider threat
• Capabilities
• Intent
• Threat models

• Rules to complete assessment
• Password policies
• Data isolation
• Key management
• Limitations
  1. Limited network access
  2. Limited storage access

- Clearly defined objectives based on regulations

Information Gathering and Vulnerability Identification - 22%

• Hosts
• Networks
• Domains
• Users
• Groups
• Network shares
• Web pages
• Applications
• Services
• Tokens
• Social networking sites

- Packet crafting
- Packet inspection
- Fingerprinting
- Cryptography

• Certificate inspection

- Eavesdropping

• RF communication monitoring
• Sniffing
  1. Wired
  2. Wireless

- Decompilation
- Debugging
- Open Source Intelligence Gathering

• Sources of research
  1. CERT
  2. NIST
  3. JPCERT
  4. CAPEC
  5. Full disclosure
  6. CVE
  7. CWE

• Discovery scan
• Full scan
• Stealth scan
• Compliance scan

- Container security
- Application scan

• Dynamic vs. static analysis

- Considerations of vulnerability scanning

• Time to run scans
• Protocols used
• Network topology
• Bandwidth limitations
• Query throttling
• Fragile systems/non-traditional assets

• False positives

- Prioritization of vulnerabilities
- Common themes

• Vulnerabilities
• Observations
• Lack of best practices

• Cross-compiling code
• Exploit modification
• Exploit chaining
• Proof-of-concept development (exploit development)
• Social engineering
• Credential brute forcing
• Dictionary attacks
• Rainbow tables
• Deception

Attacks and Exploits - 30%

• Spear phishing
• SMS phishing
• Voice phishing
• Whaling

- Elicitation

• Business email compromise

- Interrogation
- Impersonation
- Shoulder surfing
- USB key drop
- Motivation techniques

• Authority
• Scarcity
• Social proof
• Urgency
• Likeness
• Fear

• NETBIOS name service
• LLMNR

- SMB exploits
- SNMP exploits
- SMTP exploits
- FTP exploits
- DNS cache poisoning
- Pass the hash
- Man-in-the-middle

• ARP spoofing
• Replay
• Relay
• SSL stripping
• Downgrade

- DoS/stress test
- NAC bypass
- VLAN hopping

• Karma attack
• Downgrade attack

- Deauthentication attacks
- Fragmentation attacks
- Credential harvesting
- WPS implementation weakness
- Bluejacking
- Bluesnarfing
- RFID cloning
- Jamming
- Repeating

• SQL
• HTML
• Command
• Code

- Authentication

• Credential brute forcing
• Session hijacking
• Redirect
• Default credentials
• Weak credentials
• Kerberos exploits

- Authorization

• Parameter pollution
• Insecure direct object reference

- Cross-site scripting (XSS)

• Stored/persistent
• Reflected
• DOM

- Cross-site request forgery (CSRF/XSRF)
- Clickjacking
- Security misconfiguration

• Directory traversal
• Cookie manipulation

- File inclusion

• Local
• Remote

- Unsecure code practices

• Comments in source code
• Lack of error handling
• Overly verbose error handling
• Hard-coded credentials
• Race conditions
• Unauthorized use of functions/unprotected APIs
• Hidden elements
  1. Sensitive information in the DOM
• Lack of code signing

• Windows
• Mac OS
• Linux
• Android
• iOS

- Unsecure service and protocol configurations
- Privilege escalation

• Linux-specific
  1. SUID/SGID programs
  2. Unsecure SUDO
  3. Ret2libc
  4. Sticky bits
• Windows-specific
  1. Cpassword
  2. Clear text credentials in LDAP
  3. Kerberoasting
  4. Credentials in LSASS
  5. Unattended installation
  6. SAM database
  7. DLL hijacking
• Exploitable services
  1. Unquoted service paths
  2. Writable services
• Unsecure file/folder permissions
• Keylogger
• Scheduled tasks
• Kernel exploits

- Default account settings
- Sandbox escape

• Shell upgrade
• VM
• Container

- Physical device security

• Cold boot attack
• JTAG debug
• Serial console

• RPC/DCOM
  1. PsExec
  2. WMI
  3. Scheduled tasks
• PS remoting/WinRM
• SMB
• RDP
• Apple Remote Desktop
• VNC
• X-server forwarding
• Telnet
• SSH
• RSH/Rlogin

- Persistence

• Scheduled jobs
• Scheduled tasks
• Daemons
• Back doors
• Trojan
• New user creation

- Covering your tracks

Penetration Testing Tools - 17%

• oA
• oN
• oG
• oX

• Reconnaissance
• Enumeration
• Vulnerability scanning
• Credential attacks
  1. Offline password cracking
  2. Brute-forcing services
• Persistence
• Configuration compliance
• Evasion
• Decompilation
• Forensics
• Debugging
• Software assurance
  1. Fuzzing
  2. SAST
  3. DAST

- Tools

• Scanners
  1. Nikto
  2. OpenVAS
  3. SQLmap
  4. Nessus
• Credential testing tools
  1. Hashcat
  2. Medusa
  3. Hydra
  4. Cewl
  5. John the Ripper
  6. Cain and Abel
  7. Mimikatz
  8. Patator
  9. Dirbuster
  10. W3AF
• Debuggers
  1. OLLYDBG
  2. Immunity debugger
  3. GDB
  4. WinDBG
  5. IDA
• Software assurance
  1. Findbugs/findsecbugs
  2. Peach
  3. AFL
  4. SonarQube
  5. YASCA
• OSINT
  1. Whois
  2. Nslookup
  3. Foca
  4. Theharvester
  5. Shodan
  6. Maltego
  7. Recon-NG
  8. Censys
• Wireless
  1. Aircrack-NG
  2. Kismet
  3. WiFite
• Web proxies
  1. OWASP ZAP
  2. Burp Suite
• Social engineering tools
  1. SET
  2. BeEF
• Remote access tools
  1. SSH
  2. NCAT
  3. NETCAT
  4. Proxychains
• Networking tools
  1. Wireshark
  2. Hping
• Mobile tools
  1. Drozer
  2. APKX
  3. APK studio
• MISC
  1. Searchsploit
  2. Powersploit
  3. Responder
  4. Impacket
  5. Empire
  6. Metasploit framework

• Looping
• Flow control

- I/O

• File vs. terminal vs. network

- Substitutions
- Variables
- Common operations

• String operations
• Comparisons

- Error handling
- Arrays
- Encoding/decoding

Reporting and Communication - 16%

• Executive summary
• Methodology
• Findings and remediation
• Metrics and measures
  1. Risk rating
• Conclusion

- Risk appetite
- Storage time for report
- Secure handling and disposition of reports

• Removing shells
• Removing tester-created credentials
• Removing tools

- Client acceptance
- Lessons learned
- Follow-up actions/retest
- Attestation of findings

• People
• Process
• Technology

- Findings

• Shared local administrator credentials
• Weak password complexity
• Plain text passwords
• No multifactor authentication
• SQL injection
• Unnecessary open services

- Remediation

• Randomize credentials/LAPS
• Minimum password requirements/password filters
• Encrypt the passwords
• Implement multifactor authentication
• Sanitize user input/parameterize queries
• System hardening

• Critical findings
• Stages
• Indicators of prior compromise

- Reasons for communication

• Situational awareness
• De-escalation
• De-confliction

- Goal reprioritization