Study guide
18.1 PowerShell, Python, and Bash Attack Automation
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
18.1 PowerShell, Python, and Bash Attack Automation
Key Takeaways Explain This Topic AI
Objective 4.10 automates attacks already taught in Domain 4 (35 percent of PT0-003): match the language and named library to the job, rather than writing a new exploit class or repeating 2.3 recon snippets.
PowerSploit is a PowerShell module collection; PowerView is AD situational awareness and enumeration; PowerUpSQL is SQL Server attack and audit helpers; AD search is Get-ADUser, Get-ADComputer, and related cmdlets.
Constrained Language Mode and execution policy are exam speed bumps that can stop a .ps1 as written — recognize the control, and do not treat a bypass recipe as the 4.10 skill.
Bash on 4.10 is attack glue: input/output management (redirects, pipes, loops over in-scope targets) and data manipulation (grep and cut fields from tool output).
Python: Impacket implements SMB, DCE-RPC, and Kerberos for Windows networks; Scapy crafts packets. Pick PowerShell on Windows cmdlets, Bash for Linux pipes, and Python when the stem names those libraries.
Last updated: August 2026
Domain 4, Attacks and Exploits , is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.10 is Given a scenario, use scripting to automate attacks . You already learned the attacks in 4.2 through 4.9: relay, pass-the-hash, host privilege escalation, web injection, cloud IAM mistakes, wireless, social engineering, and specialized systems. 4.10 is not a new attack class. It is a matching exam : which language and which library or framework automate a job you already know. It is also not objective 2.3 . 2.3 modified short Bash, Python, or PowerShell snippets for recon and data shaping. 4.10 automates attacks . If the stem is still ping-skip and CSV, stay in Domain 2. If the stem is "enumerate Domain Admins from a PowerShell foothold," "speak SMB from Python," or "craft a TCP SYN with a library," you are in 4.10.
Work example.com the same way as every other Domain 4 chapter: stay inside written rules of engagement (RoE). A loop that hits the agreed host list is in play. A loop that sprays a payment-processor CIDR because a certificate SAN mentioned it is not. Tiny snippets in this section illustrate I/O, loops, and library names. They are not exploit payloads.
PowerShell: Windows automation and the named modules
PowerShell is the attack-automation language when the stem puts you on a Windows workstation, a domain-joined member, or a PowerShell foothold. Cmdlets return objects , not raw text you have to cut . That is why Active Directory (AD) search, session lists, and SQL Server audits live here instead of in Bash.
PowerSploit is a module collection
PowerSploit is a PowerShell module collection , not a single binary and not Metasploit. Testers import modules from the collection to automate post-exploitation jobs that 4.4 already named conceptually: host inventory, privilege-check helpers, persistence helpers, and other Windows post-exploit tasks. On objective 3.1 , CompTIA listed PowerSploit as a discovery helper. On 4.10 , the same family is an attack-automation answer: which PowerShell framework you load to automate Windows post-exploit work. When you pick it: the stem says PowerShell modules, a module collection, or "import the offensive PowerShell framework" after a Windows foothold. When you do not: the tester is on Kali with no PowerShell session and the job is SMB or DCE-RPC — that is Impacket . Do not pick PowerSploit as a Nessus replacement, as Kube-hunter, or as a packet crafter.
Exam trap: treating PowerSploit, PowerView, and PowerUpSQL as synonyms. PowerSploit is the collection . PowerView and PowerUpSQL are named members of the 4.10 PowerShell list with narrower jobs.
PowerView: AD situational awareness
PowerView is PowerShell Active Directory situational awareness and enumeration . It automates the AD questions 2.2 and 4.3 already taught: who is in Domain Admins, which computers have unconstrained delegation, who is logged on where, which ACLs grant GenericAll , what trusts exist. You pick PowerView when the stem wants PowerShell AD enum , not a BloodHound graph (that was 3.1) and not a SQL Server audit.
- Illustrative — not an exploit: Get-DomainUser -Identity j.smith
- Get-DomainGroupMember -Identity "Domain Admins"
Native AD search cmdlets do a related job without PowerView: Get-ADUser -Filter "Department -eq 'Finance'" -Properties MemberOf |
- Select-Object SamAccountName, MemberOf
- Get-ADComputer -Filter "OperatingSystem -like '*Server*'" |
- Select-Object Name
Get-ADUser , Get-ADComputer , Get-ADGroup , Get-ADObject , and LDAP -Filter / -LDAPFilter strings are the exam's AD search bullets. When you pick AD search: the stem shows the Active Directory module, a domain-joined workstation, and a query for users, computers, or groups. When you pick PowerView: the stem names PowerView or wants situational-awareness helpers (sessions, ACLs, trusts) that testers associate with that module. When you pick neither: the job is SQL Server instance hunting — that is PowerUpSQL . Exam trap: answering BloodHound for every AD question. BloodHound is a graph . PowerView and AD search are PowerShell .
PowerUpSQL: SQL Server, not AD
PowerUpSQL is a PowerShell toolkit of SQL Server attack and audit helpers . It finds SQL instances, checks authentication mode, looks at impersonation and linked-server paths, and audits weak SQL configurations. When you pick it: the stem is Microsoft SQL Server on Windows and the tester already has a PowerShell session. When you do not: Domain Admin group membership (PowerView or AD search), SMB named pipes from Linux (Impacket), or crafting TCP flags (Scapy). Exam trap: "PowerUp is PowerUpSQL." Host privilege-escalation scripts are not the SQL Server module.
Constrained Language Mode and execution policy are speed bumps
Constrained Language Mode (CLM) restricts which .NET types and language features a PowerShell session may use. Many PowerSploit-style helpers expect a Full Language session. If the stem says CLM is on, the helper does not run as written . Execution policy ( Restricted , RemoteSigned , AllSigned , Unrestricted ) controls whether a .ps1 file runs. If the stem says Restricted , the script file did not execute.
These are exam speed bumps , not a bypass lab. PT0-003 is testing whether you notice the control. The correct answer recognizes that CLM or execution policy blocked the automation, then you pick a different authorized path: an approved cmdlet, a signed script the client already allows, or a different language the RoE permits. This guide will not walk through policy bypasses, language-mode downgrades, or encoded-command tricks. Exam trap: picking "bypass execution policy" as the 4.10 skill being tested. The skill is matching the library , then noticing the control .
Bash: I/O and data manipulation as attack glue
Bash is attack-automation glue on Linux tester boxes (Kali, Parrot, a Linux jump host). CompTIA names two Bash ideas: input/output management and data manipulation . You are not authoring a new exploit. You are looping in-scope targets, feeding one tool's output into the next, and cutting the fields you need.
I/O management is redirection and pipes:
- > overwrites a file; >> appends
- < reads a file as stdin (a target list)
- 2> sends stderr; 2>&1 merges stderr into stdout
- >/dev/null discards a body you do not want in the attack log
- | pipes stdout into the next command
Data manipulation is cut , awk , grep , tr , sort , and uniq on tool output: keep the IP, drop the banner, select lines that contain 445/tcp .
- Illustrative glue — not an exploit: while read -r host; do
- grep -E ':445/' "scan-$host.txt" | cut -d: -f1 >> smb-hosts.txt
- done < inscope.txt
The while read loop walks in-scope names. < inscope.txt is input management. grep and cut are data manipulation. >> appends survivors. If the exam asks what happens when scan-mail.txt has no port 445, mail is simply omitted. If it asks why errors vanished, look for 2>/dev/null .
When you pick Bash: Linux screenshot, a file of targets, pipes, redirects, or field-cutting. When you do not: AD cmdlets on a Windows member server (PowerShell), or SMB and Kerberos protocol objects (Impacket). Exam trap: rewriting a working Bash pipe as PowerSploit because 4.10 listed PowerShell first.
Python: Impacket and Scapy
Python is the language of libraries when Bash glue is not enough and you are not in a Windows cmdlet environment.
Impacket is a Python library of SMB, DCE-RPC, and Kerberos protocol implementations for Windows networks . From a Linux tester box, Impacket is how you automate jobs 4.2 and 4.3 already taught: SMB sessions, RPC calls, Kerberos exchanges, and related Windows-network tradecraft. When you pick it: the stem says Python plus SMB, named pipes, DCERPC, Kerberos, or Windows protocol automation. When you do not: Ethernet, IP, or TCP flag crafting (that is Scapy ), PowerShell AD group membership (PowerView or AD search), or SQL Server audit from a Windows session (PowerUpSQL). Exam trap: calling Impacket a packet crafter. It implements Windows application protocols , not a generic frame builder.
Scapy is packet crafting in Python. You assemble IP, TCP, UDP, or other layers, set flags and fields, and send or sniff. 4.2 already used packet crafting as an attack type; 4.9 listed Scapy among specialized-system tools. On 4.10, Scapy is the Python library that automates that crafting.
- Illustrative — not an exploit payload: from scapy.all import IP, TCP, send
- pkt = IP(dst="10.18.0.10") / TCP(dport=80, flags="S")
- send(pkt)
When you pick Scapy: unusual flags, custom headers, protocol-field tests, or "craft a packet in Python." When you do not: "authenticate to SMB from Python" (Impacket) or "loop nmap greppable output" (Bash).
Pick the language from the OS and the API
- Stem needs Language Named 4.10 piece Not the answer
- PowerShell module collection after a Windows foothold PowerShell PowerSploit Impacket, Scapy
- AD sessions, ACLs, groups in PowerShell PowerShell PowerView PowerUpSQL, BloodHound as PowerShell
- SQL Server instance audit and attack helpers PowerShell PowerUpSQL PowerView
- Get-ADUser / Get-ADComputer filter PowerShell AD search Bash cut on /etc/passwd
- Loop targets, redirect, cut fields Bash I/O and data manipulation PowerSploit
- SMB, DCE-RPC, or Kerberos from Python Python Impacket Scapy, PowerView
- Craft TCP/IP fields in Python Python Scapy Impacket
- .ps1 blocked or CLM on PowerShell control Execution policy or CLM as a bump A bypass recipe
- Worked example.com automation
The tester has a Linux box and a Windows foothold on WS-018 in corp.example.com. RoE lists the user VLAN and the SQL cluster. From Linux, Impacket automates SMB and RPC work against in-scope file servers. Scapy is the wrong pick for that SMB session. On WS-018 , AD search or PowerView lists finance users and group membership; PowerUpSQL is the follow-on when the stem shifts to the SQL cluster. Bash on Kali cuts 445/tcp hosts from a scan file and loops only those names. If PowerShell CLM is enabled on WS-018 , PowerSploit helpers that need Full Language do not run as written — report the control, and do not treat a bypass as the 4.10 answer.
Sequence on the exam: name the OS, name the job (AD, SQL, SMB, packets, or glue), then pick PowerSploit, PowerView, PowerUpSQL, AD search, Bash I/O, Impacket, or Scapy.