Study guide
11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
Key Takeaways Explain This Topic AI
Default credentials are documented vendor logins tested in-scope with Hydra or NSE — not domain sprays and not hash cracking.
Misconfigured-services exploitation uses access the service already grants: anonymous FTP, unbound Redis, directory listing, or SNMP community public.
Certificate services on 4.2 is AD CS or misissued certs as a network service; Certify is a 4.4 host-based tool, not the 4.2 answer.
Packet crafting builds custom packets for firewall and IDS testing; msfvenom generates payloads and Metasploit runs exploit modules.
Share work on 4.2 is using a writable or overly readable share as the attack, not reprinting the 2.2 share list.
Last updated: August 2026
The rest of PT0-003 4.2 is attacks that use a service as it already stands : default credentials , misconfigured services exploitation , certificate services , share enumeration as an attack rather than the 2.2 inventory, and packet crafting . CompTIA then names nine tools. Exam items mix a printer default, an unbound Redis, an AD CS template, a writable share, and a custom packet, then wait for you to grab the wrong logo. Name the attack type first. Then pick the tool family.
Default credentials: documented factory logins, in scope only
Default credentials are the username and password the vendor shipped: admin/admin on a camera, a documented printer PIN, a switch login printed in the hardware quick-start, an application installer account nobody rotated. What it does: you authenticate as the product, not as a domain user you guessed. When you pick it: enumeration showed a management UI, SNMP, SSH, or HTTP login on an in-scope appliance and the RoE allows a short online guess. Which tool: Hydra is the 4.2 online password-guessing family. Nmap NSE scripts can check a documented default against a service. A vendor default listed in the engagement notes is still "default credentials" even if you type it once without Hydra.
Stay in-scope only . A camera CIDR that is not in the statement of work is not a free Hydra target because "IoT always has defaults." Lockout clauses in the RoE still apply: a three-attempt lockout on a production VPN is not a Hydra job. Exam trap: treating Hydra as a hash cracker. Hashcat and John the Ripper live on 4.3 . Trap two: treating a domain password spray as "defaults." Spray is 4.3. Defaults are factory or documented service logins. Trap three: answering Metasploit for every login prompt. Metasploit is the exploit framework; a printer's documented admin/admin is Hydra or the manual default, not a memory-corruption module.
Misconfigured services exploitation
Misconfigured services exploitation uses a service that is running in an unsafe state the vendor did not intend for production. Classic 4.2 pictures: anonymous FTP that lists and serves files, Redis bound on all interfaces with no AUTH, HTTP directory listing on a backup folder, SNMP community public with an informative or writable MIB, an Elasticsearch or MongoDB with no authentication, a Jenkins or Docker API that requires no login from the tester VLAN.
What it does: you exercise the permission the service already grants — read the backup, walk the MIB, retrieve objects the protocol allows — without a memory-corruption exploit. When you pick it: 2.2 or 3.1 already showed the condition; 4.2 is using it. Which tool: Nmap NSE to confirm the misconfig, Netcat to speak a simple TCP or UDP protocol by hand, Metasploit when a module exists for that service state, Impacket or CME when the service is Windows SMB or RPC.
Exam trap: answering with a scanner name when the stem already has anonymous FTP and asks what the attack is. Discovery found it. Exploitation of the misconfig is retrieving or writing with the access the service offered. Another trap: jumping to msfvenom because Redis was open. If the protocol already grants a dangerous command or a config write, you are still on misconfigured-services, not on payload generation. Stay inside RoE: anonymous read of in-scope FTP is not authorization to upload into a production web root the SoW never named.
Certificate services as a network attack surface
Certificate services on 4.2 means the network service that issues or validates certificates , especially Active Directory Certificate Services (AD CS) . The attack is the service misconfiguration: a web-enrollment endpoint reachable to low-priv users, a template that lets a normal user enroll a certificate which maps to a privileged account, a CA that still allows NTLM, or clients that will trust a misissued certificate.
When you pick it: the stem shows a CA, a certificate template, enrollment HTTP, or "the workstation accepted a certificate the real identity provider did not issue." Which tool: on this objective, stay on the service idea and on 4.2 names — Nmap or NSE to find enrollment, Impacket-family helpers when NTLM to the CA is in play. Certify is a 4.4 host-based tool. Do not pick Certify as the 4.2 answer just because the letters look like "certificate."
Exam trap: collapsing certificate services into on-path TLS. On-path failed because of a cert warning; certificate-services abuse is the CA or template being too generous. Trap two: treating every HTTPS site as "certificate services." HTTPS is transport. AD CS is an enrollment and issuance service. Trap three: treating a public certificate-transparency lookup as 4.2. CT logs were 2.1 passive recon.
Packet crafting: custom packets, not payloads
Packet crafting is building custom packets — unusual flags, options, VLAN tags, or protocol fields — that a normal client would not send, then watching how a firewall, IDS, or host stack reacts. What it does: it tests filters and parsers, not user passwords. When you pick it: you need to know whether a filter matches on destination port only, on TCP flags, on an 802.1Q tag, or on a payload pattern; or you need a probe a stock connect-scan will not send. Which tool: conceptually Scapy (also listed later under specialized-system and scripting objectives) and Nmap custom packets or NSE. Wireshark and tcpdump confirm what left the NIC.
msfvenom is not packet crafting. msfvenom generates payloads . Metasploit is the exploit framework that launches modules. Crafting a packet to test IDS is 4.2 packet crafting; building a reverse-shell blob is payload generation. Exam trap: "packet crafting" as a synonym for exploit development. Another trap: using packet crafting as the answer for VLAN hopping just because double-tagging involves tags. Hopping is the VLAN attack type ; crafting is the technique of building unusual frames. The stem will tell you which one it is scoring. A third trap: picking Netcat as a packet crafter. Netcat speaks a stream; it does not let you set arbitrary IP or TCP fields the way a crafter does.
Share enumeration as a 4.2 attack
Objective 2.2 already scored share enumeration as inventory: list SMB or NFS exports and whether guest versus authenticated access works. On 4.2 , the same bullet is the attack/use of those shares. What it does: you treat a writable share as a drop location, or you read confidential files from a share that should not have been guest- or everyone-readable. A conceptual follow-on is the always-install-elevated / software-deployment share pattern: a low-priv user can write a package or script that a privileged installer later executes. You do not need a memory exploit if the share already grants write and a privileged process already consumes it.
When you pick it: 2.2 listed FINANCE$ as guest-readable or DEPLOY$ as authenticated-user writable. 4.2 is opening the payroll spreadsheet or treating the write as the attack path. Which tool: Impacket (SMB client family) and CME (share checks at fleet scale). Netcat is the wrong family for SMB. Exam trap: reprinting the share list and calling it the 4.2 attack. Listing is 2.2. Using the write or the sensitive read is 4.2. Describe the permission and the privileged consumer in the finding; do not author a payload file as if the report were an exploit kit.
Worked services
The same /24 that held FILE01 also has a printer web UI still on the vendor default, an FTP daemon offering anonymous read of backups/ , an HTTP directory listing on /old-certs/ , SNMP public on a switch, and AD CS web enrollment. Hydra or the documented default is the printer. Anonymous FTP and directory listing are misconfigured-services exploitation — retrieve the files the service already serves. SNMP public is the same class. AD CS web enrollment plus a loose template is certificate services , not Certify-on-4.2 and not on-path TLS. CME showing DEPLOY$ writable by Domain Users is the 4.2 share attack, not another 2.2 inventory screenshot. If the stem instead asks you to build unusual TCP flags against the IDS in front of FTP, that is packet crafting with Nmap or a crafter, confirmed in Wireshark — not msfvenom.
When you drill mixed 4.2 stems — defaults versus relay versus "which tool generates the payload" — use the free PenTest+ practice questions and match the attack type before you match the logo.
4.2 tool matching (hard)
Tool 4.2 job Typical stem cue Not the answer for
Metasploit Exploit framework ; run a module against a network service "Which framework launches this service exploit?" Generating a standalone payload
msfvenom Payload generation "Which tool builds the payload?" The module launcher
Netcat Listener, file transfer, simple protocol conversation Bind or reverse listener; raw banner talk Windows AD fleet tradecraft
Nmap (NSE) Custom probes and service scripts, including some default-cred or misconfig checks Script-based confirmation of a service state NTLM relay to a second host
Impacket Windows/AD network tradecraft (SMB, RPC, relay helpers) Relay, SMB auth, RPC against Windows Online guessing of a printer web UI
CrackMapExec (CME) Windows/AD tradecraft at fleet scale: signing, shares, credential checks Many hosts, SMB signing, share writability Issuing an AD CS template by brand name
Wireshark / tcpdump Capture and confirm packets, tags, NTLM, LLMNR "What is on the wire?" Generating payloads
Responder Name-poisoning (LLMNR, NBT-NS, mDNS) Windows client failed DNS and authenticated to the tester Offline hash cracking
Hydra Online password guessing , including vendor defaults In-scope login, factory password, few attempts Pass-the-hash or hash cracking
Sequence on the exam: name the attack type first (default, misconfig, cert service, share-as-attack, crafted packet), then pick the tool family. If the stem wants a payload, msfvenom. If it wants a module runner, Metasploit. If it wants LLMNR, Responder. If it wants factory logins, Hydra. If it wants Windows network tradecraft, Impacket or CME. If it wants a listener or a file pipe, Netcat.