Study guide
20.1 Pivoting, Relays, and Additional Credential Capture
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
20.1 Pivoting, Relays, and Additional Credential Capture
Key Takeaways Explain This Topic AI
Domain 5 Post-exploitation and Lateral Movement is 14 percent of PT0-003; objective 5.2 is movement after a foothold — hop, then re-enumerate — not a tunnel cookbook.
Pivoting uses a compromised host as a hop to a network the tester laptop could not reach; 4.2 only named the multihomed NIC, and VLAN hopping is a different 4.2 attack.
Relay creation in 5.2 is a SOCKS or port-forward path so tester tools exit on the foothold; it is not 4.2 NTLM relay of a live authentication.
After you land, Domain 2 maps are stale: service discovery, network traffic discovery, additional credential capture, credential dumping, and string searches restart from the new position.
String searches with findstr or strings hunt passwords in scripts and shares; Mimikatz-style dumping on the new host is additional 5.2 capture, not a reason to dump NTDS.dit from a workstation.
Last updated: August 2026
Domain 5, Post-exploitation and Lateral Movement , is 14 percent of CompTIA PenTest+ PT0-003. Objective 5.2 — Given a scenario, perform lateral movement — starts after you already occupy a host. Persistence (5.1) was how you stay. Lateral movement is how you reach the next place . This section covers pivoting , relay creation , and the enumeration CompTIA lists under 5.2: service discovery , network traffic discovery , additional credential capture , credential dumping , and string searches . Named remote services wait for 20.2. Named tools wait for 20.3. CompTIA is scoring identification — hop versus credential-forward, second-wave enum versus first-foothold dump — not a tunnel cookbook. This guide will not give SOCKS bind recipes, proxy configuration files, or SSH forwarding command lines.
Pivoting: the hop, not the extra NIC
Pivoting is using a compromised host as a hop to a network the tester laptop could not reach on its own. The foothold already sits where you need to sit. Later scans, shells, and file copies go through that host so they appear to originate on its segment.
4.2 named the candidate. 5.2 uses it. Objective 4.2 asked you to recognize a multihomed host — two NICs, a NIC plus a VPN adapter, a workstation on the user VLAN and a restricted OT or DMZ network. That was inventory. 5.2 is the pivot : you treat that second interface as a path and you send work across it. Exam trap: answering multihomed when the stem already has a foothold on the dual-home and asks how the tester reaches the hidden subnet. Trap two: calling the pivot VLAN hopping . Hopping (4.2) abuses 802.1Q on a trunk-adjacent port from a single path. Pivoting reuses a compromised OS that already has a legitimate Layer-3 route.
When you pick pivoting: the interesting hosts live on a subnet, VLAN, or VRF the tester VLAN cannot route to, and you already control a host that can. When you do not: you are still on the same broadcast domain as the target (ordinary post-exploit on a reachable host), or the stem is only ipconfig showing a second NIC with no movement yet (still 4.2).
A pivot is not automatically Domain Admin. It is reachability . Credentials, protocols, and tools still have to match on the far side. A double-hop — jump box, then a second internal host — is still pivoting conceptually. You do not need a chaining recipe on the exam; you need to say the tester is using occupied hosts as hops rather than attacking from the original laptop address.
Pivots also inherit rules of engagement . An OT, PCI, or out-of-scope guest wireless segment that happens to be plugged into the jump box is not automatically fair game because you can route there. Record the path. Confirm the far network is in the statement of work before you treat the hop as a license to scan it.
Relay creation: SOCKS and port-forward, not NTLM relay
Relay creation in 5.2 is building a forwarding path so tester tools can talk through the foothold. Conceptually that is a SOCKS proxy — applications send TCP through a proxy listener that exits on the compromised host — or a port forward — a local port on the tester maps to a host and port only the foothold can see. The payload of the relay is your later traffic , not someone else's authentication handshake.
This is not 4.2 NTLM relay. Objective 4.2 relay forwards a live NTLM (or similar) authentication to a second host when signing is off. Tools in that story were Impacket and CrackMapExec as the Windows check-and-forward family. 5.2 relay creation is how your scanner and your shell get a path . Exam trap: picking NTLM relay whenever the word relay appears. If the stem says create a SOCKS path, port-forward to internal RDP, or make tools appear to come from the jump box, the answer is 5.2 relay creation . If the stem says signing is off and forward the captured authentication, the answer is still 4.2.
When you pick relay creation: you need a reusable path for multiple tools, or you need one specific internal listener (RDP, WinRM, an HTTPS admin UI) that only the foothold can reach. When you do not: you already have a native session on the far host, or the problem is borrow the live logon rather than borrow the route.
Relays are still in-scope and still loud. A SOCKS path that then runs a noisy fleet scan from the jump box is a rules of engagement problem, not a free pass because the packets came from inside. Exam trap two: treating every Metasploit session as automatically a relay. A session is a foothold. Autoroute-style use of that session as a route is the 5.2 idea; the named tools belong in 20.3.
Enumerate again after you land
The first recon (Domain 2) mapped what the tester laptop could see. After a pivot, that map is stale. 5.2 explicitly restarts enumeration from the new position.
Service discovery is what is listening on the newly visible network: SMB and fileshares, RDP and VNC, SSH, LDAP, RPC, FTP, Telnet, HTTP/HTTPS admin UIs, printer protocols, and the rest of the 20.2 list. You are not re-scoring Domain 2 Nmap trivia. You are asking, now that I sit on 10.50.0.0/24 , what is actually here?
Network traffic discovery is what the compromised host already talks to . Established connections, ARP or neighbor tables, DNS cache, default routes, and captured traffic from this vantage show the real next hop better than a blind sweep. Netstat and route as living-off-the-land binaries belong in 20.3; the idea belongs here: follow existing conversations. Exam trap: blasting a full TCP sweep into OT because enumeration always means scan. Traffic discovery is often quieter and more accurate.
Additional credential capture is new secrets that this position can see: a different user's interactive logon, a service account the jump box uses to mount a share, an SNMP community on the OT VLAN, a browser saved password, a scheduled-task password in an XML file. You did not have these from the first workstation dump.
Credential dumping in 5.2 is another dump on another host (or a deeper dump now that you have a better integrity level). Objective 4.4 introduced dumping LSASS, SAM, and NTDS.dit with Mimikatz as the named tool. 5.2 is why you do it again : each new host is a new secret store. Exam trap: treating every Mimikatz mention as 4.4 only. If the stem is mid-lateral-movement and the tester dumps the jump box to unlock the next hop, that is 5.2 additional dumping. Trap two: dumping NTDS from a workstation because dumping is dumping. NTDS.dit still lives on a domain controller.
String searches are the quiet cousin of dumping. findstr.exe (Windows) and strings (binaries, memory images, scripts) hunt for password , connection strings, API keys, BEGIN RSA , and unattend-style leftovers. Typical places after a foothold: scheduled-task XML, web.config and .env files, backup scripts on a share, PowerShell history, and installer leftovers. CompTIA lists string searches under 5.2 enumeration because lateral movement often starts with a password someone left in a file, not with a new exploit. Exam trap: calling findstr a 2.3 recon script. Using it after a foothold to unlock the next host is 5.2.
Capture versus dump is a matching distinction. Capture is whatever this position newly observes — a hash on the wire, a password in a script, a ticket in a new logon. Dump is extracting the host's stored secrets (LSASS, SAM, and similar). Both are 5.2 when they happen because you moved . Neither is a command block in the report.
Worked hop
WS-042 is a domain workstation on 10.4.20.0/24 . Host inventory (4.2) showed a second NIC on 10.50.0.0/24 (OT). That was multihomed . 5.2 is the pivot : the tester uses WS-042 as the hop so scanners and shells reach OT. Relay creation is the SOCKS-style or port-forward path that makes the tester's tools exit on WS-042 — not an NTLM relay against FILE01 on the user VLAN. From that vantage, network traffic discovery shows WS-042 already talks SMB to FILE-OT and a limited TCP session to a PLC. Service discovery on the new subnet finds RDP on an HMI, Telnet (cleartext) on a legacy controller, and an HTTP printer UI. String searches on a backup script hit a service-account password. Additional credential capture and a credential dump on WS-042 (Mimikatz conceptually, after the 4.4 privilege story) turn that password and any live OT logon into the next hop's authentication material. None of that is a tunnel recipe. Name the hop, name the relay as a path, name the second-wave enum.
Technique What it does When you pick it Exam trap
Pivot Use a compromised host as a hop to an unreachable network Dual-home or jump box already occupied; tester VLAN cannot route there Calling 4.2 multihomed the movement itself; calling it VLAN hopping
Relay creation SOCKS or port-forward path so tools exit on the foothold Need a reusable path or one internal listener 4.2 NTLM relay / Impacket live-auth forward
Service discovery Find listeners on the newly visible net After the hop, the Domain 2 map is stale Re-scoring 2.2 as if you never left the tester laptop
Network traffic discovery See what the foothold already talks to netstat, route, or capture from the box Blind-scanning OT because that is enum
Additional creds / dump New secrets from the new position New host, new user, new share Mimikatz-only as 4.4; NTDS from a workstation
String searches findstr or strings for passwords and keys in files Scripts, unattend leftovers, shares, binaries Calling findstr a Domain 2 OSINT tool
Sequence on the exam: identify that you cannot reach the far net from the laptop, pick pivot , create a relay (path, not NTLM), then enumerate again — services, existing traffic, string searches, additional dumps — before you pick a protocol in 20.2.