Study guide
8.1 Network, Host, Authenticated, and Wireless Scans
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
8.1 Network, Host, Authenticated, and Wireless Scans
Key Takeaways Explain This Topic AI
Domain 3 Vulnerability Discovery and Analysis is 17 percent of PT0-003; objective 3.1 is choosing scan types, not exploiting findings.
Network scans include TCP full-connect, stealth half-open SYN, and UDP; stealth is still active because the SYN lands on the host.
Host-based scans inventory the local OS — installed software, missing patches, and localhost listeners that a CIDR banner sweep cannot see.
Authenticated scans use credentials and reveal missing KBs and local services; unauthenticated scans show the outsider banner view of the same host.
Wireless on 3.1 is SSID scanning, channel scanning, and signal-strength scanning — RF inventory, not a Domain 4 wireless attack.
Last updated: August 2026
Domain 3, Vulnerability Discovery and Analysis , is 17 percent of CompTIA PenTest+ PT0-003. Objective 3.1 — Given a scenario, conduct vulnerability discovery using various techniques — is a matching skill: pick the scan type that fits the asset, the authorization, and the vantage point. Discovery is not exploitation. In the Penetration Testing Execution Standard (PTES), this work still sits in vulnerability analysis . You are building an evidence-backed list of weaknesses. You are not firing an exploit, dumping the Security Account Manager, or proving ransomware. Exam stems that jump from a banner CVE to a working payload are testing Domain 4, not 3.1.
The first cluster of 3.1 types is the classic perimeter-and-host set: network scans (TCP, UDP, and stealth), host-based scans, authenticated versus unauthenticated scans, and wireless scans (SSID, channel, and signal strength).
Network scans: TCP, UDP, and stealth
A network scan probes live addresses from the tester's vantage — a laptop, jump box, or cloud scanner that can route to the in-scope Classless Inter-Domain Routing (CIDR) block. It answers which ports respond and which remote services look vulnerable from that path .
TCP scanning uses Transmission Control Protocol. A full-connect scan completes the three-way handshake (SYN, SYN-ACK, ACK) and then usually tears the session down. The operating system can log a real connection. A stealth scan in CompTIA's 3.1 sense is the half-open SYN pattern: send SYN, record SYN-ACK (open) or RST (closed), and do not send the final ACK . You learned that a port would accept a connection without becoming a fully established session. Modern firewalls and intrusion-detection systems still see those SYNs. "Stealth" is not invisibility. It is a quieter TCP technique than a completed connect, and it is still active .
UDP scanning uses User Datagram Protocol. There is no handshake. An ICMP Port Unreachable often means closed. Silence can mean open, filtered, or rate-limited — which is why UDP is slower and more ambiguous than TCP. You still need UDP when the asset is Domain Name System (UDP 53), Simple Network Management Protocol (UDP 161), Internet Key Exchange (UDP 500), or an industrial or voice listener that never speaks TCP.
Exam trap: treating stealth as passive reconnaissance . A SYN still lands on the host. Objective 2.1 passive recon does not send that packet. Another trap: memorizing twenty Nmap flags. PT0-003 3.1 wants the concept — full TCP connect versus stealth SYN versus UDP — and the decision of when each is appropriate, not a cheat sheet of scanner syntax.
Network scans see what the path exposes . Banners, TLS certificates, and service fingerprints produce remote CVE matches. They do not magically see a missing Windows knowledge base (KB) article or a service bound only to 127.0.0.1 .
Host-based scans
A host-based scan runs on the endpoint: an agent, a local scanner package, or a collection job that queries the operating system as if you were logged on. It inventories installed software, patch level, local listeners, registry or configuration keys, and missing security updates that no banner will ever mention.
Host-based is the answer when the stem says the tester has a laptop image, a golden machine image, or an approved agent on the server, and the goal is local weakness rather than a path from 10.0.0.0/24 . It is not the same as a network TCP scan of that host, and it is not the same as static review of source code.
Authenticated versus unauthenticated
Unauthenticated scans use no credentials . They show the outsider view : open ports, banners, default pages, and CVEs that can be inferred without logging in. Authenticated scans use approved credentials — Windows domain or local accounts, SSH keys, SNMP community strings, database logins, or API tokens — so the scanner can read patch databases, local services, file permissions, and missing hotfixes.
In the field, a credentialed Tenable Nessus scan of a Windows host is both "using the network" and "seeing host state." The exam still treats the bullets as distinct. Host-based names the vantage (on the box). Authenticated versus unauthenticated names whether you had credentials. You can run an unauthenticated network scan, an authenticated network scan, and a host-based agent scan against the same IP and get three different inventories.
Worked example: 10.0.0.0/24 and host 10.0.0.14
The statement of work names 10.0.0.0/24 . An unauthenticated Tenable Nessus scan of the subnet finds 10.0.0.14 with Apache listening on TCP 80 and a banner-matched CVE for the advertised 2.4.x string. That is a valid outsider finding. It is also incomplete. The same host, scanned again with a domain account , reports a missing Windows security KB and a local service running as SYSTEM that never appeared in the banner. Credentials changed the vantage, not the IP.
Exam trap: calling the authenticated scan "stealth" because it used a valid login, or calling the unauthenticated scan "passive" because it did not log in. Login state is authenticated versus unauthenticated. Packet completeness is stealth versus full connect. Those axes are independent. You can run a stealth SYN scan with no credentials, and you can run a noisy full-connect authenticated scan.
Scan type Question it answers Typical evidence Not the same as
TCP full-connect Which TCP ports complete a handshake from this path? Established session to 80/tcp on 10.0.0.14 A completed exploit
TCP stealth (half-open SYN) Which TCP ports would accept a connection, without finishing ACK? SYN-ACK or RST Passive OSINT
UDP Which UDP services respond or stay ambiguous? ICMP unreachable, timeout, or app reply A faster version of TCP
Host-based What is installed and listening locally on this OS? Missing KB, localhost service A CIDR banner sweep
Unauthenticated What does an outsider see? Apache banner CVE on 10.0.0.14 Proof there are no local vulns
Authenticated What do valid credentials reveal on the same host? Missing KB; local SYSTEM service Stealth scanning
Wireless scans on 3.1: SSID, channel, signal strength
Wireless on objective 3.1 is a scan type , not the Domain 4 attack playbook. CompTIA names three techniques.
SSID scanning lists service set identifiers that are advertised (and, with more work, names that leak in client probe requests). Channel scanning records which channel and band an access point uses — 2.4 GHz versus 5 GHz versus 6 GHz, and the channel number that matters for overlap and for later authorized testing. Signal-strength scanning records received signal strength (RSSI or a similar reading) so you can tell which AP is actually in the engagement space, which is a neighbor, and where a tester would need to stand to stay in-scope.
This is adjacent to objective 2.2 wireless enumeration (SSID, hidden networks, clients, WPA2 versus WPA3), but 3.1 is asking you to treat wireless as vulnerability-discovery instrumentation : scan the air for identifiers, channels, and power, then decide whether an in-scope AP is weak, mis-sited, or outside the agreed RF window. Deauthentication, evil twins, and handshake cracking are objective 4.7. Hearing a neighbor guest network in the parking lot does not put it in the /24 .
Keep the worked example honest. The Nessus pass on 10.0.0.0/24 did not assess the office SSID. If rules of engagement include wireless, add an SSID, channel, and signal-strength pass; do not assume the wired scan covered the air.
Sequence on the exam: pick the vantage (network path, host agent, credentials, or RF), pick TCP versus UDP versus stealth only when the stem is about packets, and do not call discovery an exploit.