CompTIA PenTest+ PT0-002 Cert Guide

Omar Santos is an active member of the cybersecurity community who leads several industry-wide initiatives. He is a best-selling author and trainer. Omar is the author of more than 20 books and video courses, as well as numerous whitepapers, articles, and security configuration guidelines and best practices. Omar is a principal engineer of the Cisco Product Security Incident Response Team (PSIRT), Security Research and Operations, where he mentors and leads engineers and incident managers during the investigation and resolution of cybersecurity vulnerabilities.Omar co-leads the DEF CON Red Team Village, is the chair of the OASIS Common Security Advisory Framework (CSAF) technical committee, is the co-chair of the Forum of Incident Response and Security Teams (FIRST) Open Source Security working group, and has been the chair of several initiatives in the Industry Consortium for Advancement of Security on the Internet (ICASI). His active role helps businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of their critical infrastructures. You can find additional information about Omar’s current projects at h4cker.org and can follow Omar on Twitter @santosomar.

• Introduction xxixChapter 1 Introduction to Ethical Hacking and Penetration Testing 3“Do I Know This Already?” Quiz 3Foundation Topics 7Understanding Ethical Hacking and Penetration Testing 7Exploring Penetration Testing Methodologies 9Building Your Own Lab 15Exam Preparation Tasks 20Review All Key Topics 20Define Key Terms 20Q&A 20Chapter 2 Planning and Scoping a Penetration Testing Assessment 23“Do I Know This Already?” Quiz 23Foundation Topics 26Comparing and Contrasting Governance, Risk, and Compliance Concepts 26Explaining the Importance of Scoping and Organizational or Customer Requirements 39Demonstrating an Ethical Hacking Mindset by Maintaining Professionalism and Integrity 48Exam Preparation Tasks 50Review All Key Topics 50Define Key Terms 51Q&A 51Chapter 3 Information Gathering and Vulnerability Scanning 55“Do I Know This Already?” Quiz 55Foundation Topics 59Performing Passive Reconnaissance 59Performing Active Reconnaissance 93Understanding the Art of Performing Vulnerability Scans 125Understanding How to Analyze Vulnerability Scan Results 136Exam Preparation Tasks 141Review All Key Topics 142Define Key Terms 142Q&A 143Chapter 4 Social Engineering Attacks 145“Do I Know This Already?” Quiz 145Foundation Topics 149Pretexting for an Approach and Impersonation 149Social Engineering Attacks 151Physical Attacks 155Methods of Influence 170Exam Preparation Tasks 171Review All Key Topics 171Define Key Terms 172Q&A 172Chapter 5 Exploiting Wired and Wireless Networks 175“Do I Know This Already?” Quiz 175Foundation Topics 180Exploiting Network-Based Vulnerabilities 180Exploiting Wireless Vulnerabilities 216Exam Preparation Tasks 234Review All Key Topics 234Define Key Terms 235Q&A 235Chapter 6 Exploiting Application-Based Vulnerabilities 237“Do I Know This Already?” Quiz 237Foundation Topics 244Overview of Web Application-Based Attacks for Security Professionals and the OWASP Top 10 244How to Build Your Own Web Application Lab 255Understanding Business Logic Flaws 256Understanding Injection-Based Vulnerabilities 257Exploiting Authentication-Based Vulnerabilities 273Exploiting Authorization-Based Vulnerabilities 279Understanding Cross-Site Scripting (XSS) Vulnerabilities 281Understanding Cross-Site Request Forgery (CSRF/XSRF) and Server-Side Request Forgery Attacks 288Understanding Clickjacking 289Exploiting Security Misconfigurations 289Exploiting File Inclusion Vulnerabilities 292Exploiting Insecure Code Practices 293Exam Preparation Tasks 301Review All Key Topics 301Define Key Terms 302Q&A 303Chapter 7 Cloud, Mobile, and IoT Security 305“Do I Know This Already?” Quiz 305Foundation Topics 309Researching Attack Vectors and Performing Attacks on Cloud Technologies 309Explaining Common Attacks and Vulnerabilities Against Specialized Systems 324Exam Preparation Tasks 336Review All Key Topics 337Define Key Terms 337Q&A 338Chapter 8 Performing Post-Exploitation Techniques 341“Do I Know This Already?” Quiz 341Foundation Topics 345Creating a Foothold and Maintaining Persistence After Compromising a System 345Understanding How to Perform Lateral Movement, Detection Avoidance, and Enumeration 355Exam Preparation Tasks 371Review All Key Topics 371Define Key Terms 372Q&A 372Chapter 9 Reporting and Communication 375“Do I Know This Already?” Quiz 375Foundation Topics 379Comparing and Contrasting Important Components of Written Reports 379Analyzing the Findings and Recommending the Appropriate Remediation Within a Report 385Explaining the Importance of Communication During the Penetration Testing Process 390Explaining Post-Report Delivery Activities 393Exam Preparation Tasks 395Review All Key Topics 395Define Key Terms 395Q&A 396Chapter 10 Tools and Code Analysis 399“Do I Know This Already?” Quiz 399Foundation Topics 403Understanding the Basic Concepts of Scripting and SoftwareDevelopment 403Understanding the Different Use Cases of Penetration Testing Tools and Analyzing Exploit Code 409Exam Preparation Tasks 505Review All Key Topics 506Define Key Terms 508Q&A 508Chapter 11 Final Preparation 513Tools for Final Preparation 513Suggested Plan for Final Review/Study 517Summary 518Glossary of Key Terms 519Appendix A Answers to the “Do I Know This Already?” Quizzes and Q&A Sections 537Appendix B CompTIA® PenTest+ PT0-002 Cert Guide Exam Updates 559Online Elements:Appendix C Study PlannerGlossary of Key TermsTOC, 9780137566068, 10/21/2021