Study guide
14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
Key Takeaways Explain This Topic AI
LFI includes a local path; RFI fetches and includes a remote URL when an allow_url_include-style setting exists; a web shell is an uploaded or included command page; ACE is the impact, not a separate logo.
API abuse on 4.5 includes BOLA/IDOR on object URLs, mass assignment of extra JSON fields, missing rate limits, and broken authentication — Postman is the API client.
JWT manipulation is broken validation: algorithm none, a weak HMAC secret, or missing exp/aud checks — not 4.3 pass-the-token reuse of a still-valid stolen token.
Session hijacking uses a stolen or fixed session id in the tester's client; CSRF instead uses the victim's browser. Brute-force and collision target password forms, short OTPs, short session ids, and weak hashes.
Tool matching: Burp Suite or ZAP intercept HTTP; Postman APIs; sqlmap SQLi; Gobuster/DirBuster/Wfuzz content discovery; WPScan WordPress; TruffleHog secrets in application repositories.
Last updated: August 2026
The rest of PT0-003 4.5 is file-backed execution, API and token abuse, and session attacks: local file inclusion (LFI) , remote file inclusion (RFI) , web shells , arbitrary code execution (ACE) , API abuse , JSON Web Token (JWT) manipulation , session hijacking , plus brute-force and collision against application secrets. CompTIA lists ACE as an attack type; on this exam treat it as the impact several of these techniques produce, not as a separate brand of payload. You still intercept with Burp Suite or ZAP . You still discover hidden upload paths with Gobuster , DirBuster , or Wfuzz . You do not paste web-shell source into a finding.
LFI versus RFI versus web shell versus ACE
Local file inclusion uses an include, require, or template-path parameter to pull a file already on the server . Identification: a page or language parameter such as ?page=help that will also take a local path and return file contents — source, configuration, or a well-known operating-system file in an authorized test. LFI is disclosure first. It becomes ACE when the included local file is attacker-controlled (an uploaded document the engine will parse, a log the tester can write). You do not need a recipe for log poisoning; know that LFI plus a writable local file is how inclusion becomes execution.
Remote file inclusion is the same include feature pointed at a remote URL, historically when a language setting such as allow_url_include — or an equivalent "fetch this URL and evaluate it" — is enabled. Identification: the parameter accepts a remote URL and the application fetches it. Impact is ACE because the remote resource can be code. If remote includes are disabled, the finding is LFI, not RFI. Exam trap: labeling every ?file= parameter RFI. Trap two: calling traversal LFI. Parent-directory sequences that download a file are directory traversal (previous section). LFI is the include function treating that path as code or as a rendered template.
A web shell is an uploaded or included command page — a small application file that takes a parameter and runs it as the web user. On 4.5 it arrives through unrestricted upload, a writable include directory, or RFI/LFI that lands a page. Objective 5.1 also lists web shells as a backdoor persistence mechanism. On 4.5 you identify the application flaw that allowed the page. On 5.1 you discuss keeping it. Do not write web-shell source in a report or on this exam. Describe the upload or include, the resulting ACE, and the control that was missing (type allowlist, execution location outside the web root, authentication on the upload).
Arbitrary code execution is what you call the impact when the application runs the tester's code: command injection, SSTI, unsafe deserialization, RFI, a web shell, or a file upload the server executes. ACE is not "the Metasploit logo." If the stem shows a language include of a remote URL, the attack type is RFI; ACE is the impact. If the stem shows an uploaded command page, the attack type is a web shell; ACE is still the impact.
- Finding What is included or run? Needs remote fetch? Typical impact
- LFI Local file path No Read files; ACE only with a writable local file
- RFI Remote URL as code or content Yes (allow_url_include-style) ACE
- Web shell Uploaded or included command page Upload or include path ACE plus a 5.1 persistence story
- ACE Impact label n/a The server ran attacker-controlled code
- API abuse
API abuse on 4.5 is using the interface as designed, but without the authorization, rate limit, or field control the business needed.
BOLA / IDOR on APIs: change /api/v1/users/1001 to 1002 with the same bearer token. This is the API spelling of the previous section's IDOR.
Mass assignment: the client sends extra JSON fields ( isAdmin , role , balance ) and the server binds them because the framework mapped the whole body.
Missing rate limit: password reset, one-time passcode, or login endpoints that accept thousands of guesses — the brute-force bullet applied to APIs.
Broken authentication: missing auth on an admin route, HTTP-verb tampering, or trusting a client-supplied user-id header.
Postman is the 4.5 API client. Collection runners replay parameterized requests and Authorization headers. Burp and ZAP still intercept the browser or sit as a proxy in front of Postman. Exam trap: answering sqlmap for every JSON 500. Trap two: answering BloodHound. BloodHound graphs Active Directory, not REST object ids. Trap three: answering WPScan because the API is written in PHP. WPScan is WordPress -specific plugin, theme, and user enumeration.
JWT manipulation
A JSON Web Token is a header, payload, and signature. PT0-003 cares about broken validation , not minting a tutorial token.
Algorithm none: the header claims the token is unsigned; a naive library accepts modified claims with an empty signature.
Weak secret: HMAC tokens signed with a guessable passphrase. Brute-force recovers the secret; collision thinking applies when the hash or truncated MAC is too small. TruffleHog may already have found that secret in a Git repository or an application .env committed years ago.
Missing exp / aud checks: expired tokens still work; a token minted for app A is accepted by app B.
Pass-the-token (objective 4.3 ) reuses a valid stolen access, refresh, or session token. 4.5 JWT manipulation is breaking validation . Burp or ZAP is the intercept; Postman is how you replay the modified Authorization header. Exam trap: calling every Bearer token Kerberos. Trap two: treating TruffleHog as an HTTP intercept proxy.
Session hijacking, brute-force, and collision
Session hijacking is using a victim's session identifier as your own. Theft paths: XSS-stolen cookies, an unencrypted cookie on the wire, a token in a URL, or session fixation (force a known id, then wait for the victim to log in). Impact: you are the user until expiry or rotation. CSRF uses the victim's browser; hijacking uses the identifier in your client. Rotate session ids at login, set cookie flags the exam expects you to recognize (HttpOnly, Secure, SameSite), and do not put session ids in URLs.
Brute-force on 4.5 is not only a 4.3 Hydra SSH story. Application brute-force is password forms, short numeric OTPs, predictable password-reset tokens, and short session ids . Missing API rate limits make it cheap. A stem that shows ten thousand POST /login attempts with no lockout is brute-force, not SQLi, unless the body also contained query syntax.
Collision attacks matter when the application uses a weak hash or a short identifier. Two different inputs that hash to the same value, or a session-id space small enough that a tester can land on a live id, are collision or brute-force problems. They are not SQLi. They are why session identifiers need cryptographically strong length and why password hashes need a slow algorithm — identification, not a collision-lab write-up. Weak HMAC secrets on JWTs sit in the same bucket: the algorithm is fine, the secret is guessable, TruffleHog or brute-force explains why.
4.5 tool matching (hard)
- Tool 4.5 job Stem cue Not the answer for
- TruffleHog Secrets in application repos and files Git history API key or JWT HMAC secret Intercepting HTTP
- Burp Suite Intercept, replay, tamper HTTP "Captured the request" WordPress plugin enumeration by brand
ZAP Intercept and DAST-style proxy, same job family as Burp Open-source proxy in the stem Active Directory attack paths
- Postman API collections and auth headers REST or GraphQL, status codes, Bearer tokens SMB relay
- sqlmap Automate SQLi Injectable parameter already found XSS, SSTI, or CSRF
Gobuster / DirBuster Content discovery (directories and files) Hidden paths, backups, admin panels SQL union automation
- Wfuzz Content and parameter fuzzing Wordlist against a parameter or path Kerberos roasting
- WPScan WordPress enumeration (plugins, users, known issues) The CMS is WordPress Every PHP application
- Worked matching
Gobuster finds /upload and /backup . An unrestricted upload that later appears as an executable page under /upload/ is a web shell path with ACE impact; describe the missing type check, do not paste the file body. A language parameter that includes a local configuration file is LFI ; the same parameter fetching a remote URL is RFI . Postman changing userId 1001 to 1002 on /api/orders is API IDOR/BOLA . Extra JSON "role":"admin" that sticks is mass assignment . A JWT that still authorizes after the header algorithm is set to none is JWT manipulation . Stealing the session cookie via stored XSS is session hijacking . Ten thousand POST /login attempts with no lockout is brute-force . A three-character session id that collides with a live session is collision . TruffleHog in the app repo revealing a committed HMAC secret explains why the JWT was brute-forceable. Name the attack type first, then the logo. Drill mixed 4.5 stems on the free PenTest+ practice questions .