PNPT Master Exam Playbook

01 Exam mindset and methodology

1.1 The objective

Approach the PNPT as a professional penetration tester conducting an authorized engagement. Your job is not simply to run tools and collect vulnerabilities. Your job is to identify weaknesses, validate them, chain findings, achieve the defined objectives, and communicate the results.

1. Identify the attack surface.
2. Discover and validate security weaknesses.
3. Establish initial access.
4. Enumerate the internal environment.
5. Identify privilege-escalation opportunities.
6. Move laterally where justified.
7. Achieve the engagement objectives.
8. Document the attack chain and report professionally.

1.2 Core decision-making process

• What do I know, and what have I not enumerated?
• What assumptions am I making?
• What evidence supports my hypothesis?
• What privileges do I currently possess?
• What additional access could this provide?
• What is preventing progress, and what alternative paths exist?

1.3 Rules of engagement

• Identify authorized domains and IP ranges.
• Review engagement objectives and prohibited activities.
• Understand data-handling and evidence requirements.
• Establish a testing timeline and note-taking process.
• Create an evidence directory and secure credential store.

02 Reconnaissance and OSINT

2.1 Objective

Develop an understanding of the target organization before actively probing infrastructure. Use information gathered to form testable hypotheses, not assumptions.

2.2 OSINT checklist

• Identify primary and subsidiary domains.
• Identify public-facing infrastructure and associated IPs.
• Research employees, technical personnel, and organizational structure.
• Identify email naming conventions from public information.
• Review job postings for technology-stack clues.
• Identify cloud platforms, VPNs, remote access, and security products.
• Review DNS, MX, TXT, SPF, DMARC, and certificate records.
• Identify subdomains and publicly indexed files.
• Record source URLs, dates, and confidence in each finding.

2.3 Tool references

2.4 Decision point

03 External enumeration

3.1 Objective

Identify exposed services, application technologies, potential vulnerabilities, and authentication opportunities. Identify the service, understand its behavior, and validate suspected weaknesses rather than relying solely on scanner output.

3.2 Nmap command reference

Copy# Host discovery
nmap -sn TARGET_RANGE

# Default scripts and service/version detection
nmap -sC -sV TARGET_IP

# All TCP ports
nmap -p- -T3 TARGET_IP

# Detailed enumeration of selected ports
nmap -sC -sV -p PORTS TARGET_IP

# Save results in multiple formats
nmap -sC -sV -oA target_scan TARGET_IP

Choose timing and scan options appropriate to the scope and environment. Avoid aggressive scans where the rules of engagement prohibit them.

3.3 Common service investigation

3.4 Web application assessment

• Map login, registration, password reset, and account workflows.
• Review authentication and authorization boundaries.
• Identify exposed administrative interfaces, APIs, files, and directories.
• Review input validation and output encoding.
• Assess file upload and download functionality.
• Investigate relevant injection and server-side request risks.
• Validate suspected issues and capture reproducible evidence.

3.5 Tool references

Nmap NSE: service-specific enumeration. Burp Suite: proxying and web application testing. OWASP ZAP: web security testing. Gobuster / Feroxbuster: content discovery. WhatWeb: technology fingerprinting. Nikto: web server checks.

3.6 Decision points

• Open port: identify service and version, enumerate configuration, research relevant weaknesses, and validate.
• Web application: map functionality, test access controls, inspect inputs, and identify information exposure.
• Credentials discovered: record source and account type, then validate only against authorized services.

04 Initial access

4.1 Objective

Obtain an initial foothold through a validated, in-scope weakness. Initial access may come from a vulnerable service, web application issue, exposed credentials, weak authentication, or another permitted attack vector. Do not assume it must originate from the website.

4.2 Initial access checklist

• Identify the vulnerable system and relevant weakness.
• Understand prerequisites and potential impact.
• Validate exploitability safely and within scope.
• Record the initial account, hostname, IP, and operating system.
• Identify privileges, domain membership, interfaces, and routes.
• Identify reachable systems and relevant security controls.

4.3 First commands after access

Copywhoami
id
hostname
uname -a
ip addr
ip route
cat /etc/os-release

Copywhoami
whoami /all
hostname
systeminfo
ipconfig /all
route print
net user
net localgroup administrators

4.4 Questions to answer

1. What account am I using: local or domain?
2. What privileges do I possess?
3. Is the machine domain-joined?
4. What other systems can I reach?
5. What credentials or configuration information are accessible?
6. What security controls or network restrictions are present?

05 Internal enumeration and Active Directory

5.1 Objective

Understand relationships among users, computers, groups, services, trusts, and permissions. Build an accurate model of the environment before attempting escalation.

5.2 Domain discovery commands

Copywhoami /user
whoami /groups
echo %USERDOMAIN%
echo %LOGONSERVER%
set
nltest /dsgetdc:DOMAIN

5.3 Active Directory enumeration checklist

• Identify the domain name and domain controllers.
• Enumerate domain users, groups, and computers.
• Identify privileged groups and delegated roles.
• Identify service accounts and SPNs.
• Review group memberships and nested groups.
• Enumerate SMB shares and accessible resources.
• Review accessible scripts, configuration, deployment, and backup files.
• Investigate ACLs, delegation, trusts, and local administrator relationships.
• Record collection coverage and any enumeration limitations.

5.4 Tool references

5.5 BloodHound methodology

1. Collect authorized Active Directory data.
2. Import the data into BloodHound.
3. Review domain structure and privileged objects.
4. Examine relationships and candidate attack paths.
5. Investigate the permissions and prerequisites behind each path.
6. Validate relevant relationships in the environment.
7. Document the result and the access it provides.

Relationships worth recognizing include GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, AdminTo, MemberOf, HasSession, and delegation relationships.

06 Credential attacks

6.1 Objective

Identify opportunities to obtain additional credentials or authenticate using material already discovered. Protect captured credentials and hashes as sensitive evidence.

6.2 Techniques to understand

6.3 Kerberoasting workflow

1. Enumerate domain accounts and identify accounts with SPNs.
2. Determine whether the account is a relevant, in-scope target.
3. Request the applicable service-ticket material using an approved method.
4. Preserve the resulting hash securely.
5. Attempt offline password recovery.
6. Validate any recovered credential in an authorized context.
7. Review account group membership, privileges, and potential escalation value.

6.4 Credential investigation checklist

• Record the source and context of discovered credential material.
• Identify account type, ownership, and group memberships.
• Investigate service-account privileges and SPNs.
• Review accessible configuration files, scripts, and scheduled tasks.
• Determine whether authentication provides useful access.
• Store secrets securely and redact them from ordinary notes.

6.5 Troubleshooting

• Hash won't crack: validate format and cracking configuration, then consider password strength and alternate avenues.
• Pass-the-Hash fails: verify hash format, protocol support, reachability, NTLM restrictions, and account permissions.
• Credentials work on one host only: distinguish local from domain accounts and examine service-specific authorization and account restrictions.

07 Privilege escalation

7.1 Objective

Move from the current security context to a more privileged one. Separate local privilege escalation from domain-level privilege escalation.

7.2 Windows investigation checklist

• Review service configuration and permissions.
• Investigate scheduled tasks and startup mechanisms.
• Review token privileges and group membership.
• Investigate stored credentials and sensitive files.
• Review installed software and patch status.
• Investigate registry and file-system permissions.

Windows tools: WinPEAS, PowerUp, Seatbelt, PrivescCheck, AccessChk.

7.3 Linux investigation checklist

• Review sudo permissions.
• Investigate SUID/SGID binaries and Linux capabilities.
• Review writable directories, cron jobs, and scheduled tasks.
• Investigate services, PATH configuration, and file permissions.
• Review kernel and package patch status.
• Investigate stored credentials and configuration files.

Linux tools: LinPEAS, Linux Exploit Suggester, pspy, GTFOBins.

7.4 Decision points

• Local administrator/root obtained: reassess accessible credentials, privileged sessions, network access, and whether the host is a stepping stone.
• No path found: recheck enumeration completeness, permissions, installed software, scheduled tasks, and credentials.
• Domain privilege path identified: validate the specific relationship and prerequisites before attempting escalation.

08 Lateral movement and network pivoting

8.1 Objective

Expand access from the initial foothold to other authorized systems. Treat lateral movement as a chain of validated identity, authorization, and network-reachability conditions.

8.2 Lateral movement checklist

• Identify reachable hosts and network segments.
• Investigate SMB, WinRM, and RDP access where authorized.
• Identify credential reuse and account scope.
• Review local administrator relationships and privileged sessions.
• Investigate service-account access and domain trusts.
• Document segmentation and pivot requirements.

8.3 Tool references

NetExec: network authentication and enumeration. Impacket: Windows protocol utilities. Evil-WinRM: WinRM access in authorized labs. smbclient: SMB access. Chisel / SSH: tunneling. Proxychains: routing supported applications through proxies.

8.4 Pivoting questions

1. Which network interfaces and routes exist?
2. Which internal hosts can the compromised system reach?
3. Which services are available internally?
4. Are outbound connections restricted?
5. Which approved tunneling methods are permitted?

8.5 Troubleshooting

• Reachable but authentication fails: verify credentials, authentication method, account scope, and permissions.
• Internal host unreachable: check routes, segmentation, firewall policy, and whether an authorized pivot is possible.
• Tunnel fails: verify endpoints, listener, port availability, routing, and connection errors.

09 AV, EDR, and egress restrictions

9.1 Objective

Understand how defensive controls affect testing and troubleshoot failures methodically. The PNPT includes assessment of AV bypassing and egress restrictions; study the concepts and permitted lab techniques in the current course material.

9.2 Defensive control discovery

• Identify antivirus and endpoint protection products.
• Review Defender status and relevant configuration.
• Identify application control and PowerShell restrictions.
• Review host firewall and outbound network policy.
• Investigate proxy, DNS, and egress restrictions.

9.3 Failure triage matrix

10 Domain compromise and objective validation

10.1 Objective

Demonstrate the required level of compromise against the Active Directory environment and Domain Controller. Local administrator access is not automatically domain compromise.

10.2 Final validation checklist

• Identify the Domain Controller and domain.
• Establish and validate the privileges obtained.
• Confirm the defined engagement objective.
• Document the successful attack path and systems involved.
• Capture evidence supporting the result.
• Record business impact and remediation opportunities.

10.3 Reconstruct the attack chain

1. How was the organization and attack surface discovered?
2. What weakness provided initial access?
3. Which account and host were compromised?
4. What internal information was discovered?
5. What weakness or permission enabled escalation?
6. How did lateral movement occur?
7. How was the final objective achieved and validated?

11 Reporting and debrief

11.1 Objective

Communicate the engagement so another security professional, IT administrator, or executive can understand what happened, why it matters, and how to fix it.

11.2 Evidence collection checklist

• Capture screenshots showing meaningful results, not just tools running.
• Preserve commands, output, timestamps, hostnames, and IP addresses.
• Record the account and privilege context.
• Document reproducible steps and the observed impact.
• Redact secrets and sensitive data from report evidence.
• Link related findings to show the complete attack chain.

11.3 Suggested report structure

1. Executive Summary: purpose, scope, overall posture, major findings, business impact.
2. Scope and Methodology: systems, dates, authorized activities, limitations.
3. Findings: title, severity, affected assets, description, evidence, impact, reproduction, remediation.
4. Attack Narrative: initial access through final objective.
5. Remediation: prioritized corrective actions.
6. Conclusion: overall assessment and key recommendations.

11.4 Finding template

12 Troubleshooting decision matrix

Use this when progress stalls. Determine why a technique failed before abandoning an attack path.

13 Interactive note-taking templates

The tables below are editable. Use the controls under each table to add rows or columns. Click a cell to enter your own values. Your changes are saved in this browser.

13.1 Asset inventory

13.2 Credential inventory

13.3 Attack path tracker

13.4 Activity log

13.5 Phase notes

14 Tool quick reference

Tool familiarity matters, but knowing when and why to use a tool—and how to interpret its output—is more important.

15 Final PNPT readiness checklist

Reconnaissance

• Conduct OSINT and identify email conventions.
• Discover subdomains and exposed infrastructure.
• Investigate technology stacks and public information.

External penetration testing

• Perform comprehensive authorized Nmap enumeration.
• Enumerate common services and web applications.
• Identify authentication weaknesses and validate vulnerabilities.
• Obtain initial access in a practice environment.

Internal enumeration and Active Directory

• Enumerate Windows systems, users, groups, and shares.
• Identify domain controllers, service accounts, and SPNs.
• Collect and interpret BloodHound data.
• Recognize dangerous ACLs and delegation relationships.

Credential attacks and escalation

• Explain Kerberoasting and AS-REP Roasting.
• Perform offline password analysis in a lab.
• Explain Pass-the-Hash and credential reuse.
• Perform Windows and Linux privilege-escalation enumeration.

Lateral movement and defensive controls

• Understand SMB, WinRM, RDP, and remote authentication.
• Understand network pivoting and troubleshoot tunnels.
• Identify AV/EDR controls and egress restrictions.
• Troubleshoot connectivity, authentication, and execution failures.

Reporting

• Maintain organized notes and meaningful screenshots.
• Document the complete attack chain.
• Explain impact and provide practical remediation.
• Prepare an executive summary and professional debrief.

16 Final field principles