Free Online Course · Self-paced · Hands-on

CompTIA PenTest+ (PT0-003) Certification Course

Free CompTIA PenTest+ (PT0-003) course with a Kali and Proxmox lab, all five exam domains, and hands-on labs for recon, AD, web, and reporting.

  • 15 chapters
  • 107 lessons
  • ~60h
  • Intermediate
  • Tested with Kali Linux Rolling 2026.2
  • Updated Sep 2026
Start the course View syllabus
CompTIA PenTest+ (PT0-003) Certification Course
By Last updated

About this course

This is a free, self-paced course that follows the CompTIA PenTest+ (PT0-003) blueprint from pre-engagement scoping through post-exploitation cleanup. The syllabus is grouped by official exam domain so you study in certification order, while the left sidebar groups the same lessons by topic for day-to-day lookup while you work in Kali.

The part most cert courses skip is a target you can actually attack. This course ships with two lab tracks: a Proxmox track that runs Kali alongside GOAD-Light for realistic Active Directory work, and a lighter VirtualBox track with Kali, Metasploitable, and DVWA on a host-only network. Both stay isolated on your own hardware, and every technique here assumes written authorization for the systems you test, which is itself a full exam domain.

If you are new, start with Before You Begin to build a lab, then work the domains in order. If you are already testing and just want the credential, jump to the domains you are weakest on, most people find Attacks and Exploits and Reconnaissance and Enumeration carry the most weight.

What you'll learn

  • Scope and plan an engagement, set rules of engagement, and write a professional report
  • Run passive and active reconnaissance, enumeration, and OSINT with industry tools
  • Conduct vulnerability scans, validate findings, and rule out false positives
  • Execute network, host, web, API, cloud, wireless, and social-engineering attacks in authorized labs
  • Attack Active Directory with Kerberoasting, pass-the-hash, relay, and spraying techniques
  • Move laterally, establish persistence, exfiltrate safely, and document cleanup
  • Automate attack workflows with Bash, Python, and PowerShell where the objectives require scripting

Who this course is for

  • Aspiring penetration testers who want a structured path through the full engagement
  • Security analysts and SOC staff moving into offensive and red-team work
  • Sysadmins and network engineers who want to understand how their systems get attacked
  • Anyone booked on, or considering, the CompTIA PenTest+ (PT0-003) exam

Prerequisites

  • Security+-level networking, operating system, and security fundamentals
  • Comfortable on the Linux command line and with virtualization
  • A lab that can run Kali plus target VMs (16 GB RAM minimum, 32 GB for a local AD range)
  • Legal warning: only test systems you own or have explicit written authorization to assess

Exam objectives covered

CompTIA PenTest+ (PT0-003) blueprint — 5 domains · official objectives

  1. Engagement Management13%

    • Summarize pre-engagement scoping, rules of engagement, and agreement types
    • Apply legal and ethical considerations, including authorization letters and mandatory reporting
    • Compare testing frameworks and methodologies
    • Explain penetration test report components and recommend remediation

  2. Reconnaissance and Enumeration21%

    • Apply active and passive information-gathering and OSINT techniques
    • Perform DNS, service, and directory enumeration
    • Use tools such as Nmap, Wireshark, and Shodan for discovery
    • Modify Python, PowerShell, and Bash scripts for recon and enumeration

  3. Vulnerability Discovery and Analysis17%

    • Conduct authenticated, unauthenticated, SAST, and DAST scans
    • Analyze output to validate findings and rule out false positives
    • Use discovery tools such as Nessus, Nikto, and OpenVAS

  4. Attacks and Exploits35%

    • Perform network attacks such as on-path and service exploitation
    • Run authentication attacks like brute force, pass-the-hash, and credential stuffing
    • Conduct host-based attacks, privilege escalation, and credential dumping
    • Perform web, API, and cloud attacks, and explain attacks against AI systems

  5. Post-exploitation and Lateral Movement14%

    • Establish and maintain persistence
    • Move laterally throughout the environment
    • Summarize staging and exfiltration, then perform cleanup and restoration

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Kali Linux Rolling 2026.2 Attacker OS for every tool lesson (kali-rolling)
Proxmox VE 9.2 Proxmox lab track host for the Active Directory range
Oracle VirtualBox 7.x VirtualBox lab track for Kali, Metasploitable, and DVWA
GOAD-Light main (Aug 2026) Three-node Active Directory forest for the AD attack labs
Metasploit Framework 6.4.x Core exploitation tooling, paired with Nmap 7.99

Syllabus

15 chapters · 107 lessons · ~60h of reading

  1. 1 Before You Begin — Lab, Legality, and Tooling 11 lessons · ~2h 44m
    1. Part 1 Penetration testing lab requirements 21 min read
    2. Part 2 Build a PenTest+ home lab (VirtualBox) 14 min read
    3. Part 3 Proxmox pentest lab setup 11 min read
    4. Part 4 Install Kali Linux on Proxmox 18 min read
    5. Part 5 Install Metasploitable 2 on Proxmox 10 min read
    6. Part 6 Deploy GOAD-Light on Proxmox 27 min read
    7. Part 7 Install DVWA on Kali Linux 14 min read
    8. Part 8 Metasploitable 2 exploitation walkthrough 17 min read
    9. Part 9 Install Kali Linux in VirtualBox 9 min read
    10. Part 10 Legal authorization and rules of engagement 13 min read
    11. Part 11 ProxyChains and Tor on Kali Linux 10 min read
  2. 2 Domain 1 — Engagement Management (13%) 6 lessons · ~1h 28m
    1. Part 12 Pre-engagement scoping and agreements 14 min read
    2. Part 13 Pentest methodologies and frameworks 18 min read
    3. Part 14 How to write a penetration test report 19 min read
    4. Part 15 Analyze findings and recommend remediation 12 min read
    5. Part 16 Collaboration, communication, and risk articulation 14 min read
    6. Part 17 Manage pentest projects with Cervantes 11 min read
  3. 3 Domain 2 — Reconnaissance and Enumeration (21%) 14 lessons · ~3h 37m
    1. Part 18 Passive recon and OSINT for pentesters 23 min read
    2. Part 19 Shodan and Censys attack-surface discovery 15 min read
    3. Part 20 OSINT automation with SpiderFoot 13 min read
    4. Part 21 Email enumeration with theHarvester 16 min read
    5. Part 22 DNS enumeration and subdomain discovery 17 min read
    6. Part 23 Subdomain enumeration with Amass and tools 13 min read
    7. Part 24 Network scanning and OS fingerprinting with Nmap 16 min read
    8. Part 25 Nmap Scripting Engine (NSE) for enumeration 18 min read
    9. Part 26 Banner grabbing and service enumeration 16 min read
    10. Part 27 SMTP, SMB, and share enumeration 14 min read
    11. Part 28 Web content discovery and directory enumeration 15 min read
    12. Part 29 Secrets enumeration in repos and files 12 min read
    13. Part 30 Network sniffing with Wireshark and tcpdump 14 min read
    14. Part 31 Modify Bash and Python scripts for recon 15 min read
  4. 4 Domain 3 — Vulnerability Discovery and Analysis (17%) 10 lessons · ~2h 26m
    1. Part 32 Vulnerability scanning concepts and scan types 12 min read
    2. Part 33 Web vulnerability scanning with Nikto 14 min read
    3. Part 34 Network scanning with OpenVAS and Greenbone 21 min read
    4. Part 35 Vulnerability scanning with Nessus 13 min read
    5. Part 36 Container and IaC scanning with Trivy and Grype 17 min read
    6. Part 37 Kubernetes attack surface with kube-hunter 15 min read
    7. Part 38 AD attack-path mapping with BloodHound 18 min read
    8. Part 39 Kali vulnerability scanner tools overview 12 min read
    9. Part 40 Validate scan results and select public exploits 12 min read
    10. Part 41 Physical security testing concepts 12 min read
  5. 5 Domain 4a — Network Attacks 5 lessons · ~1h 14m
    1. Part 42 Prioritize attacks with CVSS, CVE, and EPSS 17 min read
    2. Part 43 Metasploit Framework end to end 18 min read
    3. Part 44 Man-in-the-middle via ARP spoofing 16 min read
    4. Part 45 LLMNR and NBT-NS poisoning with Responder 13 min read
    5. Part 46 Service exploitation with netexec and Impacket 10 min read
  6. 6 Domain 4b — Authentication and Active Directory Attacks 8 lessons · ~1h 50m
    1. Part 47 Password cracking with John the Ripper 14 min read
    2. Part 48 Hash cracking with hashcat 17 min read
    3. Part 49 Custom wordlists for password attacks 13 min read
    4. Part 50 Online brute force with Hydra and Medusa 12 min read
    5. Part 51 Password spraying and credential stuffing 18 min read
    6. Part 52 Pass-the-hash and pass-the-ticket attacks 13 min read
    7. Part 53 Kerberoasting and AS-REP roasting 13 min read
    8. Part 54 NTLM relay attacks 10 min read
  7. 7 Domain 4c — Host-Based Attacks and Privilege Escalation 5 lessons · ~1h 4m
    1. Part 55 Linux privilege escalation techniques 17 min read
    2. Part 56 Windows privilege escalation techniques 13 min read
    3. Part 57 Credential dumping with Mimikatz 12 min read
    4. Part 58 Payload obfuscation and AV evasion 11 min read
    5. Part 59 Windows payloads and RATs 11 min read
  8. 8 Domain 4d — Web Application and API Attacks 15 lessons · ~3h 7m
    1. Part 60 Web pentesting with DVWA 11 min read
    2. Part 61 Intercepting traffic with Burp Suite 12 min read
    3. Part 62 SQL injection with sqlmap 15 min read
    4. Part 63 Cross-site scripting (XSS) attacks 12 min read
    5. Part 64 OS command injection 8 min read
    6. Part 65 Server-side template injection (SSTI) 7 min read
    7. Part 66 Local file inclusion (LFI), path traversal, and RFI 9 min read
    8. Part 67 Server-side request forgery (SSRF) 9 min read
    9. Part 68 Cross-site request forgery (CSRF) 9 min read
    10. Part 69 How to bypass CSRF protection 14 min read
    11. Part 70 Insecure deserialization 13 min read
    12. Part 71 IDOR and BOLA (broken object-level authorization) 13 min read
    13. Part 72 API pentesting with Postman and Burp 19 min read
    14. Part 73 WordPress pentesting with WPScan 22 min read
    15. Part 74 ffuf web fuzzing (dirs, params, vhosts) 14 min read
  9. 9 Domain 4e — Cloud and Container Attacks 4 lessons · ~1h 2m
    1. Part 75 AWS cloud penetration testing fundamentals (IAM, IMDS, SSRF) 15 min read
    2. Part 76 AWS auditing with Prowler and ScoutSuite 12 min read
    3. Part 77 AWS exploitation with Pacu 13 min read
    4. Part 78 Docker container escape and hardening checks 22 min read
  10. 10 Domain 4f — Wireless Attacks 3 lessons · ~38 min
    1. Part 79 WPA/WPA2 handshake capture and cracking 15 min read
    2. Part 80 Evil twin and rogue AP attacks 12 min read
    3. Part 81 WPA2 honeypot and deauth 11 min read
  11. 11 Domain 4g — Social Engineering 5 lessons · ~1h 10m
    1. Part 82 Social engineering attack types 13 min read
    2. Part 83 Phishing with the Social Engineering Toolkit 13 min read
    3. Part 84 Gophish phishing campaign tutorial 11 min read
    4. Part 85 Browser exploitation with BeEF 13 min read
    5. Part 86 Advanced phishing with Evilginx 20 min read
  12. 12 Domain 4h — Specialized Systems (Mobile, AI, OT, RF) 10 lessons · ~2h 38m
    1. Part 87 Android Studio AVD pentest lab (free) 12 min read
    2. Part 88 Genymotion Desktop lab (Pro trial & adb) 12 min read
    3. Part 89 Android app pentesting with MobSF 15 min read
    4. Part 90 Android static analysis with APKHunt 17 min read
    5. Part 91 Frida Android tutorial (frida-server and hooks) 13 min read
    6. Part 92 Android SSL pinning bypass with Frida and Burp 19 min read
    7. Part 93 Drozer Android IPC and exported components 15 min read
    8. Part 94 Android insecure data storage testing 18 min read
    9. Part 95 LLM prompt injection attacks 22 min read
    10. Part 96 OT/ICS security testing (Modbus, PLC, CAN) 15 min read
  13. 13 Domain 4i — Scripting to Automate Attacks 3 lessons · ~44 min
    1. Part 97 Python for pentesters (scripts & automation) 14 min read
    2. Part 98 PowerShell for pentesters 14 min read
    3. Part 99 Breach and attack simulation with Atomic Red Team 16 min read
  14. 14 Domain 5 — Post-Exploitation and Lateral Movement (14%) 7 lessons · ~1h 38m
    1. Part 100 Reverse and bind shells explained 10 min read
    2. Part 101 Establishing persistence on Linux and Windows 16 min read
    3. Part 102 C2 frameworks — Sliver, Mythic, Metasploit & how CALDERA fits 13 min read
    4. Part 103 SSH pivoting and tunneling 20 min read
    5. Part 104 Lateral movement with PsExec, WMI, and WinRM 16 min read
    6. Part 105 Data exfiltration techniques — staging, HTTPS, DNS, ICMP & covert channels 12 min read
    7. Part 106 Cleanup and restoration 11 min read
  15. 15 PenTest+ Cheat Sheet 1 lesson · ~7 min
    1. Part 107 CompTIA PenTest+ (PT0-003) cheat sheet 7 min read

Hands-on labs

6 guided builds you run yourself

  1. Deploy a three-node Active Directory forest (GOAD-Light)

    Build a realistic Windows AD range on Proxmox so the authentication and lateral-movement labs have real targets.

  2. Map a target with Nmap host discovery and service detection

    Find live hosts, open ports, and service versions, then save output you can hand to the exploitation phase.

  3. Kerberoast and AS-REP roast AD service accounts

    Request and crack Kerberos tickets against GOAD-Light, then note how to detect and harden against it.

  4. Exploit SQL injection and automate it with sqlmap

    Confirm injection by hand on DVWA, escalate to UNION and blind techniques, then automate extraction with sqlmap.

  5. Pivot into a second subnet over SSH tunnels

    Use local, remote, and dynamic forwarding, ProxyChains, and sshuttle to reach hosts you cannot touch directly.

  6. Write a professional penetration test report

    Turn findings into an executive summary, scored technical findings, and remediation the client can act on.

Where to go after this course

Frequently Asked Questions

What is the PenTest+ PT0-003 exam format?

PT0-003 has a maximum of 90 questions in 165 minutes, mixing multiple-choice with performance-based tasks where you work in simulated environments. It is scored on a 100 to 900 scale with a passing score of 750. These details change between exam versions, so confirm them on the official PenTest+ page before you book.

How much does the PenTest+ exam cost?

The U.S. retail price for a single PT0-003 voucher is $439 USD, and CompTIA does not offer free retakes, so each attempt is a fresh voucher. Student, bundle, and employer discounts exist through the CompTIA store. Pricing is regional and changes over time, so check CompTIA's own store for the current figure in your country.

Do I need Network+ or Security+ before PenTest+?

No. There is no mandatory prerequisite exam, so anyone can register. CompTIA recommends Network+ and Security+ knowledge plus three to four years of hands-on penetration testing experience, but that is guidance, not a gate. The labs in this course give you the practical grounding the recommendation assumes.

What changed from PT0-002 to PT0-003?

PT0-003 launched on December 17, 2024, and the previous PT0-002 retired on June 17, 2025. The current version restructures the exam into five domains, adds a dedicated Attacks and Exploits weighting of 35%, and folds in newer topics such as attacks against AI systems, cloud, and API testing. If your study material predates 2025, check it against the current objectives first.

How long is PenTest+ valid, and how do I renew it?

The certification is valid for three years. You renew by earning 60 continuing education units (CEUs), passing the latest exam version, or earning a higher-level CompTIA certification, and you pay the continuing education fee before your expiration date. CompTIA's continuing education pages list the current fee and accepted activities.

Only against systems you own or have explicit written permission to test. Every lab in this course runs on isolated VMs on your own hardware for exactly that reason. Running scanners or exploits against production networks, third-party hosts, or the public internet without authorization is illegal in most jurisdictions, which is why scoping and rules of engagement are a graded exam domain, not an afterthought.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)