Study guide
3.2 Testing Frameworks and Methodologies
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
3.2 Testing Frameworks and Methodologies
Key Takeaways Explain This Topic AI
PTES is a seven-phase penetration testing process standard from pre-engagement through reporting; it is the closest blueprint-style 'how a pentest runs' document on the list.
OSSTMM is a broader ISECOM operational-security testing methodology with scientific measurement (including RAV), not merely a pentest playbook.
MITRE ATT&CK is an adversary technique knowledge base used to map coverage; it is not a pentest contract, RoE, or statement of work.
OWASP Top 10 is a web risk-awareness document; OWASP MASVS is a mobile application security verification standard with numbered control groups.
CREST is a professional assurance and accreditation ecosystem; the Purdue model is an ICS/OT segmentation architecture (levels 0–5) used when scoping industrial tests.
Last updated: August 2026
PT0-003 objective 1.3 is a compare-and-contrast item family. CompTIA lists seven named frameworks or methodologies plus three threat-modeling models (covered in the next section). The exam trick is mixing up what each artifact is for . A knowledge base is not a contract. An awareness list is not a full methodology. An ICS architecture diagram is not a web test plan. Learn the job of each name, then the trap answers write themselves.
After you can contrast the seven artifacts below, check yourself with the free PenTest+ practice questions .
Penetration Testing Execution Standard (PTES)
PTES is a penetration testing process standard . It describes how a pentest runs from first conversation through the report.
The seven phases
The seven sections are:
- Pre-engagement Interactions
- Intelligence Gathering
- Threat Modeling
- Vulnerability Analysis
- Exploitation
- Post Exploitation
- Reporting
When an exam stem asks which document covers scoping conversations, exploitation, post-exploitation, and reporting as one pentest lifecycle, PTES is the match. PTES is not a CVSS calculator, not an ICS zoning model, and not a list of the ten most common web risks. Teams use it to structure an SoW-friendly methodology: what happens before authorization is confirmed, what "threat modeling" means in the test, and what the customer should expect in the report.
Open Source Security Testing Methodology Manual (OSSTMM)
OSSTMM , maintained by ISECOM (Institute for Security and Open Methodologies), is a broader security testing methodology with a scientific-measurement emphasis. OSSTMM 3 is the widely cited edition. It characterizes operational security across channels, not only "can I get a shell." The channels testers should recognize are Human , Physical , Wireless , Telecommunications , and Data Networks .
OSSTMM's distinctive exam fingerprint is measurement . Tests are meant to produce repeatable characterization of operational security rather than a pile of anecdotal screenshots. ISECOM's RAV (Risk Assessment Values) calculator is the associated quantitative companion. If the stem says "scientific method," "operational security," or "channels including human and physical," think OSSTMM — not PTES. OSSTMM can include penetration testing, but it is not only a pentest playbook and it is not a web Top 10 list.
Council of Registered Ethical Security Testers (CREST)
CREST is a professional assurance and accreditation body and the methodology ecosystem around it, not a single seven-phase PDF that replaces PTES. Originating in the United Kingdom and now used internationally, CREST accredits companies, certifies individual testers (for example the CREST Registered Tester path), publishes buying guidance, and expects members to follow a professional code of conduct. Buyers use CREST membership as a quality signal when procuring a pentest. Testers use CREST syllabi and related methodologies when a customer requires CREST-assured work.
Exam trap: CREST is not "the OWASP list for the United Kingdom" and not a MITRE matrix. If the stem is about who assures the provider or which body accredits ethical security testers , CREST is the answer. If the stem is about seven pentest phases, that is PTES.
MITRE ATT&CK
MITRE ATT&CK is an adversary tactics, techniques, and procedures (TTP) knowledge base . Matrices exist for Enterprise, Mobile, and ICS. Columns are tactics (the adversary's goals, such as Credential Access or Lateral Movement); cells are techniques and sub-techniques (how those goals are attempted).
ATT&CK is how you map coverage : "we emulated T1059.001 PowerShell and T1003.003 NTDS, but we never touched T1557 adversary-in-the-middle." Purple teams, detection engineers, and pentesters all use it that way. It is not a pentest contract, not a rules-of-engagement template, and not a replacement for pre-engagement legal authorization. Putting "MITRE ATT&CK" in a proposal does not authorize you to attack production. On the exam, "map techniques," "coverage," or "adversary emulation" points to ATT&CK; "statement of work" or "seven phases" does not.
OWASP Top 10 versus OWASP MASVS
The OWASP Top 10 (Open Worldwide Application Security Project) is a web application risk-awareness document . It is periodically updated; the current published edition as of 2026 is OWASP Top 10:2025 , whose categories include Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions. PT0-003 launched against the 2023 objectives, so treat the Top 10 as a named awareness list that changes , not as a frozen ten-item methodology you must recite as a contract. The exam point is the role : testers map web findings to Top 10 categories to communicate risk to developers. It does not define pre-engagement, post-exploitation, or reporting the way PTES does, and it is not a mobile standard.
OWASP MASVS (Mobile Application Security Verification Standard) is a verification standard for mobile apps . Current MASVS control groups include STORAGE , CRYPTO , AUTH , NETWORK , PLATFORM , CODE , RESILIENCE , and PRIVACY . From v2.0 the old L1/L2/R verification levels were moved into MAS Testing Profiles / MASTG rather than living inside MASVS itself; older study notes still mention L1, L2, and R. For PenTest+, remember the job: MASVS tells you what to verify on iOS and Android applications. It is not the web Top 10, not ATT&CK Mobile (which describes adversary techniques), and not a full organizational risk method like OCTAVE.
Purdue Model (ICS/OT Scoping)
The Purdue model (Purdue Enterprise Reference Architecture, commonly applied to industrial control) is an ICS/OT network segmentation architecture , not a pentest methodology. Know the levels well enough to scope a plant without treating a PLC as "just another host."
- Level Role Examples Pentest caution
- 0 Physical process Sensors, actuators, motors Affecting Level 0 is a safety and process-integrity event
- 1 Basic control PLCs, RTUs Changing logic or setpoints can move real equipment
- 2 Supervisory control HMI, SCADA servers A tripped HMI can halt operations even without a PLC rewrite
3 Site operations MES, historians, operations workstations Common IT-looking systems that still sit on the OT side
- 4 Site business planning ERP, site IT, email IT zone; still should not freely route to Level 1
- 5 Enterprise Corporate networks and services Furthest from the process; still a pivot source if flattened
- Why Level 3 to Level 1 is unsafe
Many plants also place a DMZ (often called Level 3.5) between operations (Level 3) and business IT (Level 4). You do not need a 2,000-word ICS treatise for PT0-003. You do need this instinct: jumping from Level 3 operations to Level 1 basic control is a scoping and safety issue . It can skip supervisory protections and put a tester in a position to alter the physical process. If the RoE authorized a Level 3 historian review, that is not silent permission to flash PLC logic. Call it out, get explicit authorization, and use OT-safe methods (read-only, outages windows, vendor-approved tools) or refuse the hop.
Artifact What it is What it is not Exam cue
PTES Pentest process standard (seven phases) A scoring model or ICS zoning diagram Pre-engagement through reporting
OSSTMM Scientific operational-security methodology (ISECOM) Only a web checklist Channels, measurement, RAV
CREST Assurance/accreditation body and related methodology ecosystem A MITRE matrix Accredited testers and firms
- MITRE ATT&CK Adversary TTP knowledge base A pentest contract or RoE Map techniques and coverage
- OWASP Top 10 Web risk-awareness list A full pentest methodology Map web findings; not seven phases
- OWASP MASVS Mobile app security verification standard The web Top 10 Mobile control groups
Purdue model ICS/OT segmentation architecture (levels 0–5) A pentest execution standard Do not hop Level 3 to Level 1 unscoped
Memorize the job of each name. PTES tells you how a pentest proceeds. OSSTMM tells you how to measure operational security scientifically. CREST tells you who is accredited to do the work. ATT&CK tells you which adversary techniques you covered. Top 10 tells developers which web risk classes showed up. MASVS tells you whether a mobile app meets a verification standard. Purdue tells you where you are standing in a plant — and why the next hop may be unsafe.