Study guide
6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
Key Takeaways Explain This Topic AI
WAF enumeration on PT0-003 highlights origin address: find a customer-owned IP that is not sitting behind the web application firewall, and only probe it if it is in scope.
Origin clues include leftover DNS A records, historical resolutions, email headers, certificate SAN names, and non-proxied services such as mail, VPN, or staging.
Web crawling spiders in-scope links; manual enumeration uses robots.txt, sitemap.xml, platform plugin paths, and JavaScript route lists.
Attack-path mapping connects users, groups, computers, shares, and protocol weaknesses into a graph at enumeration time — BloodHound-style thinking without firing the exploit.
The worked chain — Windows Server 2019, 445/3389, SMB signing not required, guest IT-ARCHIVE, backup_svc in a description field — is a mapped path, not a completed attack.
Last updated: August 2026
The remaining objective 2.2 bullets are web application firewall (WAF) enumeration (with origin address called out), web crawling , manual enumeration ( robots.txt , sitemap, platform plugins), and attack path mapping . Together they answer two exam questions: how do you see the real application when a WAF sits in front, and how do you connect every earlier inventory fact into a path before you exploit anything?
WAF enumeration and origin address
A WAF is a reverse-proxy control that inspects HTTP and stops or distorts attacks before they reach the origin server. WAF enumeration first asks whether a WAF is present. Clues include vendor cookies and headers (cloud provider WAF cookies, cf-ray -style identifiers, X-Sucuri or similar security headers), unusual status codes (403, 406, 501) for harmless probes, identical block pages across applications, and timing that does not match the origin. Identifying which WAF is present matters because bypass research is product-specific — still identification, not a payload pack.
The PT0-003 sub-bullet that candidates under-study is origin address . If the WAF is the only published A record, the application origin may still have a leftover IP: an old A record in historical DNS, a hostname such as origin.example.com or direct.example.com that still resolves, a mail server whose email headers reveal an internal or cloud IP, a certificate subject-alternative name that points at a non-proxied host, or a non-proxied service on the same customer network — FTP, VPN, mail, staging, or an API on another hostname that never sat behind the WAF. Those leads are how testers find an origin. Hitting that origin to bypass the WAF is allowed only if it is in scope . A historical A record that now belongs to a previous tenant, a content delivery network anycast address, or a neighbor in a shared cloud range is not yours because a WAF annoyed you.
Exam trap: firing injection payloads at the WAF to "see which signatures trip" and calling that WAF enumeration. That is attack traffic. Another trap: declaring that any WAF makes origin hunting automatically out of scope. The RoE decides. If origin discovery is in scope and the origin is customer-owned, record the IP and whether the WAF can be bypassed by talking to it directly. If the origin is excluded, stop at detection.
Web crawling versus manual enumeration
Web crawling is an automated spider that follows in-scope links, forms, and redirects to build a map of URLs. It is how you learn the real surface of a large application instead of guessing from the homepage. Crawlers must stay on the named domain, URL prefix, or host in the statement of work. Following every third-party script host, payment iframe, or CDN origin is not thoroughness; it is leaving scope.
Manual enumeration is the complementary pass CompTIA lists explicitly. Fetch robots.txt : Disallow lines are a map of paths the owner did not want indexed — /admin , /backup , /internal-api — not a legal fence for an authorized tester. Fetch sitemap.xml (and sitemap index files) for URLs marketing wanted search engines to see, including forgotten locale copies and old campaigns. Platform plugins are the WordPress /wp-content/plugins/ and /wp-content/themes/ trees, Joomla component paths, Drupal modules, and similar fingerprints. A plugin with a known version is inventory for later vulnerability analysis; here you are naming what is installed. Read JavaScript bundles for client-side routers: /settings/api-tokens , /admin/impersonate , undocumented REST paths. Directory brute-force tooling is the later tools objective; this section's job is knowing what you are looking for by hand even when a spider already ran.
Exam trap: crawler versus reading robots.txt
If the stem shows a tester fetching robots.txt and sitemap.xml and checking WordPress plugin paths, the answer is manual enumeration. If the stem shows a spider following in-scope links to build a URL list, the answer is web crawling. You usually need both. A crawler will not see a path that no page links to; robots.txt and a plugin directory will.
Attack path mapping: graph the inventory, do not fire it yet
Attack path mapping is how users, groups, computers, shares, and protocol weaknesses connect. In Active Directory, that thinking is BloodHound-style : who is a member of which group, who has a session on which computer, who can control a Group Policy Object, which service account is over-permissioned. At the enumeration stage you are drawing the graph. You are not yet performing Kerberos attacks, not yet relaying SMB, and not yet dropping a payload. Domain 4 and Domain 5 are where a mapped path becomes an exploit chain, and only inside the RoE.
Worked example: from Nmap ports to a mapped path
Collect the chapter's facts as edges, not as trivia. Host discovery found 10.4.12.8 alive. Service discovery found 445/tcp and 3389/tcp . OS fingerprinting said Windows Server 2019 . Protocol enumeration said SMB signing is not required . Share enumeration found a guest share IT-ARCHIVE . Local user enumeration found backup_svc with a description that it runs overnight restores from that share. Secrets enumeration of the share may add a cloud key or a password file. Permission enumeration may show that backup_svc has restore or backup-related rights a normal user lacks.
Attack-path mapping says: a stranger who can read IT-ARCHIVE may recover configuration or credential material; that material may authenticate as backup_svc ; backup_svc is tied to restore operations on a Windows server that also offers RDP; unsigned SMB is a later network-attack edge against this host or its peers. That sentence is the map. It is not a completed demonstration, not ransomware, and not a reason to skip the report's evidence trail. If BloodHound (or equivalent directory data) later shows backup_svc nested into a privileged group, you add that edge. You still do not "just run the exploit" because the graph looks pretty.
Web and WAF facts join the same graph. If the company's public app sits behind a WAF but a staging hostname from sitemap.xml or a leftover A record reaches the origin, that is another edge — if that origin is in scope. If robots.txt discloses /internal-api and JavaScript lists a /restore route, those URLs may be how backup_svc is meant to work. Mapping is the habit of drawing those connections while you enumerate, so exploitation hours later are spent on the shortest realistic path instead of random high CVSS rows.
2.2 technique Question it answers In-scope example Out of bounds
WAF enumeration Is a WAF present, and where is the origin? Historical customer A record, mail headers, staging host Attacking a CDN neighbor IP
Web crawling Which in-scope URLs link to each other? Spider of app.example.com Following a payment-processor iframe
Manual enumeration What did robots, sitemaps, plugins, and JS reveal? robots.txt , sitemap.xml , WordPress plugins Treating Disallow as a legal stop
Attack path mapping How do identities, shares, and services chain? Guest IT-ARCHIVE → backup_svc → unsigned SMB Firing a destructive exploit to "complete" the map
Drill scenario items like this on free PenTest+ practice . The exam will mix a screenshot of ports with a share list and a user description and ask what you should do next . If the options include exploiting RDP, spraying passwords, or skipping documentation, the 2.2 answer is almost always: finish the inventory, map the path, stay in scope.