PenTest+ PT0-003 Cheat Sheet: Domains, Tools & Commands

Tested on	Kali GNU/Linux Rolling 2026.2 (kali-rolling)
Package	`nmap 7.99+dfsg-1kali1` `hydra 9.7-1` `john 1.9.0-Jumbo-1+git20211102-0kali10` `hashcat 7.1.2+ds1-4` `gobuster 3.8.2-1` `metasploit-framework 6.4.135-0kali1` `nikto 1:2.6.0-0kali4`
Lab environment	Pentest lab Proxmox lab
Privilege	Normal user for most recall commands; sudo only when a linked lesson requires it
Cert prep	CompTIA PenTest+ — full PT0-003 syllabus hub
Man page	nmap(1) (primary active-recon tool on this sheet)
Scope	PT0-003 domain weights, an essential command matrix, and per-domain tool recall with links to canonical lessons, plus three lab-tested Nmap and DNS examples. Not a full exam dump, not covert-channel recipes, and not a substitute for the linked deep lessons.

Short on time?Beta Get the gist of this 7-minute read in seconds, then ask follow-up questions

Use this page as a recall card while you study or sit a practice PBQ. Each domain table points to the lesson that owns the full procedure. Start from the CompTIA PenTest+ course hub for syllabus order, then set a lab target once:

bash
export TARGET=127.0.0.1

Replace 127.0.0.1 with an authorized lab host. Never scan the public internet for practice.

IMPORTANT

Run these tools only on systems you own or are explicitly authorized to test. Put scope in your rules of engagement before any client engagement.

PenTest+ PT0-003 domain weights

Domain	Weight	What you recall here
1 Engagement Management	13%	Scope, RoE, methodologies, reporting
2 Reconnaissance and Enumeration	21%	OSINT, DNS, Nmap, banners, content discovery
3 Vulnerability Discovery and Analysis	17%	Scanners, validation, prioritization
4 Attacks and Exploits	35%	Network, auth/AD, host, web, API, cloud, wireless, social engineering
5 Post-exploitation and Lateral Movement	14%	Shells, priv-esc, C2, pivoting, exfil, cleanup

Essential PenTest+ commands

Goal	Command
Discover hosts	`nmap -sn TARGET`
Scan TCP ports	`nmap -p- --open TARGET`
Detect versions	`nmap -sV -p PORTS TARGET`
Treat target as online / skip host discovery	`nmap -Pn TARGET`
DNS A record	`dig DOMAIN A`
DNS MX record	`dig DOMAIN MX`
Zone transfer	`dig axfr @NS DOMAIN`
Open TCP connection / grab banner when the service exposes one	`nc -nv TARGET PORT`
HTTP headers	`curl -I URL`
Content discovery	`gobuster dir -u URL -w WORDLIST`
Nikto scan	`nikto -h URL`
Hydra	`hydra -l USER -P FILE ssh://HOST`
John	`john HASHFILE`
Hashcat	`hashcat -m MODE HASHFILE WORDLIST`
Metasploit	`msfconsole`
Packet capture	`tcpdump -i IFACE -nn`

Domain 1 — Engagement Management

When to use	Command / recall	Lesson
Define authorization and out-of-scope systems	RoE, SoW, target list, emergency contacts	Rules of engagement
Testing methodologies and frameworks	PTES, OWASP testing guidance, NIST-style assessment methodology; map observed techniques separately with MITRE ATT&CK	Pentest methodologies
Draft findings for stakeholders	Severity, evidence, remediation, risk	Penetration test report

Domain 2 — Reconnaissance and Enumeration

When to use	Command / recall	Lesson
Passive OSINT starting point	People, domains, leaks, Wayback	OSINT tools
Email and host discovery	`theHarvester -d example.com -b all`	theHarvester
DNS A / MX / NS / TXT records	`dig example.com A` / `dig example.com MX` / `dig example.com NS` / `dig example.com TXT`	DNS enumeration
Authorized zone transfer test	`dig axfr @ns1.example.com example.com`	DNS enumeration
Find open TCP ports	`nmap -p- --open "$TARGET"`	Nmap network recon
Fingerprint known open services	`nmap -sV -p 22,80,443 "$TARGET"`	Nmap network recon
Skip host discovery when ICMP is blocked	`nmap -Pn "$TARGET"`	Nmap network recon
Quick script help	`nmap --script-help http-title`	Nmap NSE scripts
Banner on an open port	`nc -v "$TARGET" 22`	Banner grabbing
Directory and content discovery	`gobuster dir -u http://$TARGET/ -w wordlist.txt`	Hidden endpoints
Packet capture for recon	Wireshark / `tcpdump -i iface -nn`	Wireshark and tcpdump

Domain 3 — Vulnerability Discovery and Analysis

When to use	Recall / example	Lesson
Network vulnerability scanner	Nessus / OpenVAS	Nessus, OpenVAS
Web application scanner	Nikto / Burp / ZAP	Nikto, Burp Suite
Authenticated scan	Uses valid credentials; deeper host/config visibility	Vulnerability scanning
Unauthenticated scan	Tests what can be discovered without supplied credentials; often resembles an unauthenticated attacker view	Vulnerability scanning
SAST	Analyze source/code without executing the application	Vulnerability scanning
DAST	Test a running application	Vulnerability scanning
IAST	Instrument and test a running application while it is exercised	Vulnerability scanning
SCA	Identify vulnerable or outdated open-source dependencies and components	Container and IaC scanning
Other scan types	Container, mobile, IaC, and source-code scans	Kali vulnerability scanner tools
Web misconfig and known vulns	`nikto -h http://$TARGET/`	Nikto web scanner
False positive	Scanner finding that manual validation does not reproduce	Validate scan results
CVSS	Technical severity score	Vulnerability prioritization
EPSS	Estimated probability that a published CVE will be exploited in the wild	Vulnerability prioritization
Business impact	Context that can override raw scanner score	Vulnerability prioritization

Domain 4 — Attacks and Exploits

When to use	Command / recall	Lesson
Exploit framework workflows	`msfconsole` modules, payloads, handlers	Metasploit tutorial
On-path / ARP spoofing concepts	Bettercap / arpspoof lab patterns	ARP spoofing MITM
LLMNR / NBT-NS poisoning	Responder capture then crack offline	Responder LLMNR
Online password guessing	`hydra -L users.txt -P pass.txt ssh://$TARGET`	SSH brute force
Password spray	Few passwords against many users	Password spraying
Credential stuffing	Reuse known username/password pairs	Password spraying
Offline hash cracking	`john hash.txt` / `hashcat -m MODE hash.txt wordlist`	John, hashcat
Pass-the-hash / ticket reuse	Impacket / netexec patterns	Pass-the-hash
Kerberoasting / AS-REP	Ticket requests then crack offline	Kerberoasting
AD attack paths	BloodHound collection and analysis	BloodHound
SQL injection lab	Manual and tool-assisted SQLi	DVWA SQL injection
XSS lab	Reflected / stored XSS checks	XSS attack tutorial
Path/directory traversal	`../` or equivalent path manipulation to access unintended files	Local file inclusion
File inclusion (LFI/RFI)	Application includes attacker-selected local or remote resources	Local file inclusion
Command injection	Shell metacharacters; user input reaches OS command	OS command injection
SSRF	Server makes attacker-controlled backend request	Server-side request forgery
CSRF	Forged cross-site request using victim session	CSRF attack
API testing	Burp / ZAP / Postman / curl	API JWT pentesting
Wireless assessment	Aircrack-ng suite; rogue AP; evil twin	Wi-Fi cracking, Evil twin
Cloud attack surface	IAM, metadata, containers	Cloud pentesting fundamentals, Docker escape
Social engineering	Phishing, vishing, smishing, pretexting	Social engineering attacks

Domain 5 — Post-exploitation and Lateral Movement

When to use	Command / recall	Lesson
Interactive callback shell	Netcat / bash / Python reverse shell	Reverse shell cheat sheet
Linux privilege escalation checks	Kernel, SUID, sudo, cron, capabilities	Linux privilege escalation
Windows privilege escalation checks	Tokens, services, UAC, misconfigs	Windows privilege escalation
Persistence concepts	Services, scheduled tasks, accounts	Post-exploitation persistence
C2 framework comparison	Sliver, Mythic, Metasploit, CALDERA	C2 frameworks overview
Pivoting and tunneling	Proxies, port forwards, SOCKS	Pivoting and tunneling
Staging and exfiltration concepts	T1074 / T1041 / T1048 / T1567	Data exfiltration
End engagement	Remove persistence/test accounts, restore changes, verify cleanup	Cleanup and restoration

Essential command examples

Essential Discover live hosts with Nmap -sn

Confirm the target answers before you burn time on port scans. Use only an authorized address.

bash
nmap -sn "$TARGET"

Sample output (Kali lab, loopback):

output

Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-05 19:17 IST
Nmap scan report for localhost (127.0.0.1)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

Host is up means discovery succeeded. Full scan types live in the Nmap network recon lesson.

Essential Detect service versions on open ports

Run a full port scan first, then fingerprint only the ports you found open. -sV identifies the product behind each listener.

bash
nmap -sV -p 22 --open "$TARGET"

Sample output (Kali lab, loopback):

output

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.3p1 Debian 4 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Record the product and version string for exploit selection and the report.

Essential Resolve A records with dig

Query one record type at a time. ANY is often restricted on modern resolvers, so prefer explicit lookups.

bash

dig +short example.com A

Sample output at the time of testing:

output

104.20.23.154
172.66.147.243

For MX, NS, TXT, or an authorized zone transfer, see the DNS enumeration lesson.

References

CompTIA PenTest+ certification — official exam overview
Nmap Reference Guide — nmap(1) documentation
MITRE ATT&CK — Exfiltration — post-exploitation data movement tactics
OWASP Top Ten — common web risk categories

CompTIA PenTest+ (PT0-003) Cheat Sheet: Domains, Tools & Commands

PenTest+ PT0-003 domain weights

Essential PenTest+ commands

Domain 1 — Engagement Management

Domain 2 — Reconnaissance and Enumeration

Domain 3 — Vulnerability Discovery and Analysis

Domain 4 — Attacks and Exploits

Domain 5 — Post-exploitation and Lateral Movement

Essential command examples

References

Ask GLC Bot

PenTest+ PT0-003 domain weights

Essential PenTest+ commands

Domain 1 — Engagement Management

Domain 2 — Reconnaissance and Enumeration

Domain 3 — Vulnerability Discovery and Analysis

Domain 4 — Attacks and Exploits

Domain 5 — Post-exploitation and Lateral Movement

Essential command examples

References

Related Articles

Android Deep Link Security Testing with ADB

Android Exported Components Security Testing

Objection Android Pentesting Tutorial