PenTest+ · Domain 4 of 5

PenTest+ Domain 4: Attacks and Exploits

Attacks and Exploits is by far the largest PenTest+ domain. It covers prioritizing targets and then executing attacks across networks, authentication, hosts, web applications, the cloud, wireless and people, plus specialized systems and attack automation with scripting.

Exam weight
35%
Official objectives
10
Estimated questions estimate
~31
Suggested study time estimate
40–50 hrs

About 16 min read Reviewed October 2026

Overview

Domain 4 is the exploitation core of the exam. It starts with analyzing output to prioritize and prepare attacks, using CVSS, CVE, CWE and EPSS, high-value asset identification, capability and exploit selection, and documentation of the attack path. It then covers executing attacks across seven surfaces: network attacks such as on-path and relay attacks, authentication attacks such as pass-the-hash, Kerberos attacks and password spraying, host-based attacks such as privilege escalation and credential dumping, web application attacks such as SQL injection, XSS, SSRF and insecure direct object references, cloud attacks such as metadata service abuse and IAM misconfiguration, wireless attacks such as evil twin and deauthentication, and social engineering such as phishing and pretexting. It finishes with common attacks against specialized systems, including mobile, AI, OT, NFC and Bluetooth, and using scripting to automate attacks.

This domain turns the validated findings from Domain 3 into compromise, which Domain 5 then extends through persistence and lateral movement.

How it's tested

Expect many scenario and performance-based questions showing tool output, a target list or an attack situation, and asking which attack, tool or next step is appropriate. Breadth is the challenge, so recognizing the attack from its signature is the key skill.

  • Prioritize the target

    Several targets with scores, exposure and asset value are given, and you must choose what to attack first.

  • Name the attack and tool

    A situation on a specific surface is described, and you must identify the attack type and the tool that performs it.

  • Read the output

    Tool output such as hashes, a web response or a scan result is shown, and you must choose the next action.

Reasoning it through

A tester has captured NTLM hashes from a network but cannot crack them quickly. Spending hours on hashcat is tempting. But many Windows environments allow authentication with the hash itself. A pass-the-hash attack, using a tool such as Impacket or CrackMapExec, can authenticate to other systems without ever cracking the password, which is faster and quieter.

Objectives 10

Official objectives from the CompTIA outline, in outline order.

4.1 Given a scenario, analyze output to prioritize and prepare attacks.Target prioritization, descriptors and metrics, capability and exploit selection, and documentation.
What it means
This covers prioritizing targets by high-value asset identification and descriptors such as CVSS base score, CVE, CWE and EPSS, plus end-of-life software, default configurations, running services, weak encryption and the target's defensive capabilities. It covers capability selection: tool selection, exploit selection and customization through code analysis, and documentation of the attack path, low-level diagrams, storyboards, dependencies, scope limitations and labeling of sensitive systems.
What to understand
With a limited engagement window, testers attack the targets that offer the best combination of value and likely success. EPSS adds exploitation likelihood to CVSS severity. Exploits often need customization to fit the target, and scope limitations and sensitive-system labels constrain what may be attacked.
How it shows up
A set of targets or findings with metrics is given, and you must choose what to attack first or which exploit to prepare.
Common confusion
Prioritizing by CVSS base score alone, ignoring EPSS, asset value and exposure.
4.2 Given a scenario, perform network attacks using the appropriate tools.On-path, relay, VLAN hopping and other network attacks with tools such as Metasploit, Responder and Impacket.
What it means
Network attacks include default credentials, on-path (man-in-the-middle) attacks, certificate services attacks, exploiting misconfigured services, VLAN hopping, attacking multihomed hosts, relay attacks, share enumeration and packet crafting, using tools such as Metasploit, Netcat, Nmap with NSE, Impacket, CrackMapExec, Wireshark, tcpdump, msfvenom, Responder and Hydra.
What to understand
On-path and relay attacks intercept or forward authentication to gain access. Responder answers name-resolution requests to capture credentials, and relayed credentials can authenticate elsewhere. VLAN hopping crosses network segments that should be isolated. Tool choice follows the attack: Responder to capture, Impacket and CrackMapExec to relay and authenticate.
How it shows up
A network situation is described, and you must choose the attack or the tool, or read captured output.
Common confusion
Confusing an on-path attack with a relay attack. On-path intercepts traffic, while a relay forwards captured authentication to another target.
4.3 Given a scenario, perform authentication attacks using the appropriate tools.Pass-the-hash, Kerberos attacks, password spraying and more, with hashcat, John, Hydra and BloodHound.
What it means
Authentication attacks include MFA fatigue, pass-the-hash, pass-the-ticket, pass-the-token, Kerberos attacks (such as Kerberoasting), LDAP injection, dictionary, brute-force and mask attacks, password spraying, credential stuffing, and OIDC and SAML attacks, using tools such as CrackMapExec, Responder, hashcat, John the Ripper, Hydra, BloodHound, Medusa and Burp Suite.
What to understand
Pass-the-hash and pass-the-ticket reuse captured credentials without cracking them. Password spraying tries a few common passwords against many accounts to avoid lockout, unlike brute force against one account. Kerberoasting extracts service account hashes for offline cracking. BloodHound maps the Active Directory paths these attacks exploit.
How it shows up
An authentication scenario is described, and you must choose the attack technique or the tool that performs it.
Common confusion
Confusing password spraying with brute force. Spraying uses few passwords across many accounts to avoid lockouts.
4.4 Given a scenario, perform host-based attacks using the appropriate tools.Privilege escalation, credential dumping, evasion and injection, with Mimikatz, PsExec and LOLBins.
What it means
Host-based attacks include privilege escalation, credential dumping, circumventing security tools, exploiting misconfigured endpoints, payload obfuscation, user-controlled access bypass, shell and kiosk escape, library injection, process hollowing and injection, log tampering and unquoted service path injection, using tools such as Mimikatz, Rubeus, Certify, Seatbelt, PowerShell, PsExec, Evil-WinRM and living-off-the-land binaries.
What to understand
Privilege escalation turns a foothold into control, and credential dumping (for example with Mimikatz) harvests credentials for reuse. Living-off-the-land binaries use trusted built-in tools to evade detection. Unquoted service paths and misconfigurations are classic Windows privilege-escalation routes.
How it shows up
A host foothold is described, and you must choose the escalation technique, the credential-dumping tool or the evasion method.
Common confusion
Treating credential dumping as the same as cracking. Dumping harvests stored credentials or hashes directly from the host.
4.5 Given a scenario, perform web application attacks using the appropriate tools.Injection, SSRF, CSRF, directory traversal, deserialization and more, with Burp Suite, sqlmap and ZAP.
What it means
Web application attacks include brute-force and collision attacks, directory traversal, server-side request forgery (SSRF), cross-site request forgery (CSRF), deserialization attacks, injection attacks (SQL, command, XSS, server-side template injection), insecure direct object references, session hijacking, arbitrary code execution, file inclusions (RFI and LFI, web shells), API abuse and JWT manipulation, using tools such as TruffleHog, Burp Suite, ZAP, Postman, sqlmap, Gobuster, DirBuster, Wfuzz and WPScan.
What to understand
Each attack targets a specific weakness. SQL injection manipulates database queries, XSS injects script into pages viewed by others, SSRF makes the server request internal resources, and insecure direct object references expose data by changing identifiers. Burp Suite and ZAP are the core web proxies, and sqlmap automates SQL injection.
How it shows up
A web request, response or parameter is shown, and you must identify the attack or the tool.
Common confusion
Confusing SSRF with CSRF. SSRF makes the server send requests, while CSRF makes a victim's browser send requests.
4.6 Given a scenario, perform cloud-based attacks using the appropriate tools.Metadata service abuse, IAM misconfiguration, container escape and supply chain, with Pacu, Prowler and ScoutSuite.
What it means
Cloud attacks include metadata service attacks, IAM misconfigurations, abusing third-party integrations, resource misconfiguration (network segmentation and controls, IAM credentials, exposed storage buckets, public services), logging information exposure, image and artifact tampering, supply chain attacks, workload runtime attacks, container escape and trust relationship abuse, using tools such as Pacu, Docker Bench, Kube-hunter, Prowler, ScoutSuite and cloud-native vendor tools.
What to understand
The cloud metadata service can leak temporary credentials if a server can be made to query it, often via SSRF. Over-permissive IAM roles and exposed storage buckets are the most common cloud findings. Container escape breaks out of a container to the host, and trust relationship abuse pivots between accounts.
How it shows up
A cloud misconfiguration or attack path is described, and you must choose the technique or the assessment tool.
Common confusion
Overlooking that SSRF against a cloud server can reach the metadata service and harvest credentials.
4.7 Given a scenario, perform wireless attacks using the appropriate tools.Evil twin, deauthentication, WPS attacks and more, with Aircrack-ng and Kismet.
What it means
Wireless attacks include wardriving, evil twin attacks, signal jamming, protocol fuzzing, packet crafting, deauthentication, captive portal attacks and WPS PIN attacks, using tools such as WiFi-Pumpkin, Aircrack-ng, WiGLE.net, inSSIDer and Kismet.
What to understand
An evil twin is a rogue access point impersonating a legitimate one to capture credentials or traffic. Deauthentication forces clients off a network, often to capture a handshake or push them to the evil twin. WPS PIN attacks exploit a weak setup feature.
How it shows up
A wireless situation is described, and you must choose the attack or tool.
Common confusion
Confusing an evil twin with a simple rogue access point. An evil twin specifically mimics a trusted network to deceive users.
4.8 Given a scenario, perform social engineering attacks using the appropriate tools.Phishing, vishing, pretexting and more, with SET, Gophish and Evilginx.
What it means
Social engineering attacks include phishing, vishing, whaling, spearphishing, smishing, dumpster diving, surveillance, shoulder surfing, tailgating, eavesdropping, watering hole attacks, impersonation and credential harvesting, using tools such as the Social Engineering Toolkit (SET), Gophish, Evilginx, theHarvester, Maltego, Recon-ng and BeEF.
What to understand
Social engineering exploits people rather than technology and is often the most effective entry. Spearphishing targets specific individuals, whaling targets executives, and watering hole attacks compromise a site the target visits. Evilginx can relay logins to defeat some MFA, and Gophish runs phishing campaigns.
How it shows up
A human-targeted attack is described, and you must name the technique or choose the tool.
Common confusion
Confusing phishing, spearphishing and whaling. Spearphishing is targeted, and whaling targets senior executives specifically.
4.9 Explain common attacks against specialized systems.Mobile, AI, OT, NFC, Bluetooth and RFID attacks, with MobSF, Frida and Scapy.
What it means
Specialized attacks include mobile attacks (information disclosure, jailbreak or rooting, permission abuse), AI attacks (prompt injection and model manipulation), OT attacks (register manipulation, CAN bus, Modbus, plaintext and replay attacks), and NFC, Bluejacking, RFID and Bluetooth spamming, using tools such as Scapy, tcprelay, Wireshark, MobSF, Frida, Drozer, Android Debug Bridge and Bluestrike.
What to understand
This objective, new emphasis in V3, adds AI attacks such as prompt injection, where crafted input manipulates a model's behavior, and OT protocol attacks such as Modbus and CAN bus manipulation, which can affect physical processes. Mobile testing uses MobSF, Frida and Drozer.
How it shows up
A specialized target such as a mobile app, an AI system or an OT protocol is described, and you must identify the attack or tool.
Common confusion
Treating prompt injection as a traditional injection flaw. It manipulates an AI model's behavior through crafted input rather than a code interpreter.
4.10 Given a scenario, use scripting to automate attacks.Automating attacks with PowerShell, Bash and Python, and breach and attack simulation.
What it means
This covers automating attacks with PowerShell (PowerSploit, PowerView, PowerUpSQL, AD search), Bash (input and output management, data manipulation), and Python (Impacket, Scapy), plus breach and attack simulation tools such as Caldera, Infection Monkey and Atomic Red Team.
What to understand
Scripting automates repetitive attack steps and chains tools together, and the exam expects you to read and modify these scripts rather than write them from scratch. Breach and attack simulation replays known techniques to test defenses at scale.
How it shows up
A script or automation goal is shown, and you must predict its behavior, choose the right language or tool, or fix a small error.
Common confusion
Assuming the objective requires advanced development. It centers on reading, modifying and selecting the right scripted approach.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Prioritization by value and likelihood

    Attack the highest-value targets most likely to succeed first.

    Remember
    Combine CVSS severity with EPSS likelihood, exposure and asset value.
    Tested as
    Target prioritization questions.
    Trap
    Ranking by CVSS base score alone.

  • On-path vs. relay attack

    On-path intercepts traffic between two parties. A relay forwards captured authentication to another target.

    Remember
    Responder captures, and Impacket or CrackMapExec relays.
    Tested as
    Network attack questions.
    Trap
    Using the terms interchangeably.

  • Pass-the-hash and pass-the-ticket

    Authenticating with a captured hash or Kerberos ticket without cracking the password.

    Remember
    They reuse credentials directly, which is faster and quieter than cracking.
    Tested as
    Authentication attack questions.
    Trap
    Assuming the password must be cracked first.

  • Password spraying vs. brute force

    Spraying tries a few common passwords across many accounts. Brute force tries many passwords against one account.

    Remember
    Spraying avoids account lockouts.
    Tested as
    Authentication attack questions.
    Trap
    Confusing the two directions.

  • Kerberoasting

    Requesting service tickets to extract service-account hashes for offline cracking.

    Remember
    Rubeus and Impacket perform it, and BloodHound finds the targets.
    Tested as
    Kerberos attack questions.
    Trap
    Confusing it with pass-the-ticket.

  • Credential dumping

    Extracting stored credentials or hashes from a host, often with Mimikatz.

    Remember
    It harvests credentials directly rather than cracking them.
    Tested as
    Host attack questions.
    Trap
    Equating it with password cracking.

  • SSRF vs. CSRF

    SSRF makes the server send requests. CSRF makes a victim's browser send requests.

    Remember
    SSRF can reach internal services and cloud metadata.
    Tested as
    Web attack questions.
    Trap
    Swapping which party sends the request.

  • Cloud metadata service attack

    Abusing a cloud instance's metadata endpoint to steal temporary credentials.

    Remember
    Often reached through SSRF.
    Tested as
    Cloud attack questions.
    Trap
    Overlooking the SSRF-to-metadata path.

  • IAM misconfiguration

    Over-permissive cloud roles and policies.

    Remember
    It is one of the most common and impactful cloud findings.
    Tested as
    Cloud attack questions.
    Trap
    Focusing on exploits over permissions.

  • Evil twin

    A rogue access point impersonating a legitimate network.

    Remember
    Often paired with deauthentication to push clients onto it.
    Tested as
    Wireless attack questions.
    Trap
    Confusing it with a generic rogue AP.

  • Spearphishing vs. whaling

    Spearphishing targets specific people. Whaling targets senior executives.

    Remember
    Whaling is a subset aimed at high-value leaders.
    Tested as
    Social engineering questions.
    Trap
    Using the terms loosely.

  • Prompt injection

    Manipulating an AI model's behavior through crafted input.

    Remember
    It is an AI attack, not a traditional code injection.
    Tested as
    Specialized system questions.
    Trap
    Treating it like SQL injection.

  • Living-off-the-land binaries

    Using trusted built-in tools for malicious actions to evade detection.

    Remember
    Common in host attacks and lateral movement.
    Tested as
    Host and evasion questions.
    Trap
    Expecting malware files when built-in tools are used.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

On-path vs. relay vs. pass-the-hash

ConceptMeaningKey differenceCommon trap
On-path attack Intercepts traffic between two parties Positions between victim and destination Confusing it with a relay
Relay attack Forwards captured authentication to another system Reuses credentials in transit Thinking it needs the cleartext password
Pass-the-hash Authenticates with a captured hash No cracking needed Assuming the password must be cracked

Password spraying vs. brute force vs. credential stuffing

ConceptMeaningKey differenceCommon trap
Password spraying A few common passwords against many accounts Avoids lockouts Confusing it with brute force
Brute force Many passwords against one account Fast lockout risk Using it where lockout policies apply
Credential stuffing Reusing leaked username and password pairs Relies on password reuse Treating it as guessing

SQL injection vs. XSS vs. SSRF vs. IDOR

ConceptMeaningKey differenceCommon trap
SQL injection Manipulates database queries through input Targets the database Fixing it with a firewall
XSS Injects script into pages viewed by other users Targets other users' browsers Confusing stored and reflected variants
SSRF Makes the server request internal or external resources Abuses the server's access Confusing it with CSRF
Insecure direct object reference Accesses data by changing an identifier Exploits missing authorization checks Treating it as an injection flaw

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Crack before reusing

    What candidates pick
    Spend time cracking captured NTLM hashes before using them.
    Why it looks right
    Cracking recovers the real password.
    Why it's wrong
    Pass-the-hash can authenticate with the hash directly in many Windows environments, which is faster and quieter.

    Clue to watch for The scenario mentions captured hashes and a need for speed or stealth.

  2. Spray like brute force

    What candidates pick
    Try many passwords against one account to gain access.
    Why it looks right
    It is the familiar guessing approach.
    Why it's wrong
    That triggers lockouts. Password spraying uses a few common passwords across many accounts to avoid them.

    Clue to watch for Account lockout policies are mentioned.

  3. SSRF is CSRF

    What candidates pick
    Label a server making internal requests as CSRF.
    Why it looks right
    The names are similar.
    Why it's wrong
    SSRF makes the server send requests; CSRF makes a victim's browser send requests.

    Clue to watch for The server itself is reaching internal or metadata endpoints.

  4. Ignore the metadata path

    What candidates pick
    Treat an SSRF on a cloud web server as low impact.
    Why it looks right
    SSRF alone can look limited.
    Why it's wrong
    On a cloud instance, SSRF can query the metadata service and steal temporary credentials, escalating to account compromise.

    Clue to watch for The vulnerable server runs in a cloud environment.

  5. CVSS-only ranking

    What candidates pick
    Attack the highest CVSS base score first.
    Why it looks right
    The score is standardized.
    Why it's wrong
    EPSS, exposure, asset value and defensive capabilities change the real priority within a time-boxed test.

    Clue to watch for The question provides EPSS, exposure or asset value data.

  6. Prompt injection as SQLi

    What candidates pick
    Treat an AI prompt injection like a database injection flaw.
    Why it looks right
    Both are called injection.
    Why it's wrong
    Prompt injection manipulates a model's behavior through crafted input, not a code interpreter or database.

    Clue to watch for The target is an AI or large language model system.

Answer framework

For any Domain 4 attack scenario, use these steps before choosing an answer.

  1. Prioritize targets by combining severity, EPSS likelihood, exposure and asset value, and respect scope limitations and sensitive-system labels.
  2. Identify the attack surface involved, whether network, authentication, host, web application, cloud, wireless, people, or a specialized system.
  3. Choose the attack technique that fits the situation, preferring credential reuse such as pass-the-hash over slow cracking when possible.
  4. Select the tool built for that attack, such as Responder and Impacket for relays, sqlmap for SQL injection, or Aircrack-ng for wireless.
  5. Watch for high-impact pivots, such as SSRF reaching cloud metadata or IAM misconfigurations, and document the attack path as you go, noting each step.

Practice question

A web application running on a cloud virtual machine lets a user supply a URL that the server then fetches. The penetration tester wants to maximize impact. Which action is MOST likely to escalate this into broader cloud compromise?

Want more like this? The PenTest+ practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most study time by far, since it is 35% of the exam and the most hands-on. Do not try to memorize every attack at once. Work surface by surface: network, authentication, host, web, cloud, wireless, social engineering and specialized systems. For each surface, learn the signature attacks and the tools that perform them.

Build and use a lab. Running pass-the-hash with Impacket, SQL injection with sqlmap, and a capture with Responder makes the performance-based questions far easier than reading alone.

Pay special attention to the pairs the exam confuses: on-path versus relay, spraying versus brute force, SSRF versus CSRF, and spearphishing versus whaling. Also learn the SSRF-to-cloud-metadata path and IAM misconfigurations, which are high-impact and heavily tested.

The specialized systems objective (4.9), including AI prompt injection and OT protocol attacks, is a V3 emphasis, so give it real time. Afterwards, move to Domain 5, where a successful attack is extended through persistence and lateral movement.

FAQ

How much of PenTest+ PT0-003 is Domain 4?

Attacks and Exploits is 35% of the PT0-003 exam, the largest domain and more than a third of the test.

What is pass-the-hash?

Authenticating to a system using a captured password hash directly, without cracking it to recover the plaintext password. It is common in Windows environments.

What is the difference between SSRF and CSRF?

Server-side request forgery makes the server send requests the attacker controls. Cross-site request forgery makes a victim's browser send requests. On a cloud server, SSRF can reach the metadata service.

How is password spraying different from brute force?

Spraying tries a few common passwords across many accounts to avoid lockouts. Brute force tries many passwords against a single account.

Does PT0-003 cover AI attacks?

Yes. Objective 4.9 includes AI attacks such as prompt injection and model manipulation, alongside OT, mobile, NFC and Bluetooth attacks.

Do I need hands-on tool skills?

Strongly recommended. This domain has many performance-based questions, so practicing with tools such as Metasploit, sqlmap, Responder, Mimikatz and Aircrack-ng pays off.

How does Domain 4 connect to Domain 5?

A successful exploit here gives a foothold, which Domain 5 extends through persistence, lateral movement, staging and exfiltration.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered target prioritization and attacks across every surface, from networks and web apps to cloud, wireless and AI. Test whether you can pick the right attack and tool under exam conditions.

Take the PenTest+ practice test Check your PenTest+ readiness

Keep going