PenTest Plus Domain 4: Attacks and Exploits (35%) - Complete Study Guide 2027

Domain 4 Overview and Weight

Domain 4: Attacks and Exploits represents the largest portion of the PenTest Plus PT0-003 exam, weighing in at 35% of all questions. This makes it the most critical domain to master for exam success. With approximately 31-32 questions dedicated to this domain out of the maximum 90 questions, your performance here will significantly impact your overall score of 750 or higher needed to pass.

This domain focuses on the active exploitation phase of penetration testing, where testers move beyond discovery and enumeration to actually compromise systems and applications. Understanding both the theoretical concepts and practical implementation of various attack vectors is essential, as the exam includes both multiple-choice questions and hands-on performance-based questions that may require you to demonstrate actual exploitation techniques.

Web Application Attack Techniques

Web application attacks form a substantial portion of Domain 4, reflecting the reality that web applications represent one of the largest attack surfaces in modern organizations. The PT0-003 exam expects candidates to understand both common and advanced web application vulnerabilities and their exploitation methods.

SQL Injection Attacks

SQL injection remains one of the most critical web application vulnerabilities. Candidates must understand various SQL injection types including union-based, boolean-based blind, time-based blind, and error-based injections. The exam tests both manual exploitation techniques and automated tool usage, such as SQLMap for complex injection scenarios.

Understanding database-specific syntax differences is crucial, as real-world penetration tests encounter MySQL, PostgreSQL, Microsoft SQL Server, and Oracle databases. Each has unique functions and syntax that can be leveraged during exploitation, such as MySQL's load_file() function for reading system files or SQL Server's xp_cmdshell for command execution.

Cross-Site Scripting (XSS) Exploitation

XSS attacks encompass reflected, stored, and DOM-based variants. The exam covers payload construction, filter evasion techniques, and exploitation frameworks like BeEF (Browser Exploitation Framework). Candidates should understand how to chain XSS with other attacks, such as CSRF or session hijacking, to achieve more significant compromise.

XSS Type	Execution Context	Persistence	Impact Level
Reflected XSS	User interaction required	Non-persistent	Medium
Stored XSS	Automatic execution	Persistent	High
DOM-based XSS	Client-side execution	Non-persistent	Medium to High

Server-Side Request Forgery (SSRF)

SSRF attacks have gained prominence due to cloud infrastructure adoption. The exam covers both blind and non-blind SSRF exploitation, including attacks against internal services, cloud metadata endpoints (AWS EC2 metadata at 169.254.169.254), and protocol smuggling techniques.

Network-Based Attack Vectors

Network attacks remain fundamental to penetration testing, and the PT0-003 exam extensively covers both traditional and modern network exploitation techniques. Understanding protocol weaknesses, traffic manipulation, and network service exploitation is essential for success in this domain.

Man-in-the-Middle (MITM) Attacks

MITM attacks exploit network positioning to intercept and potentially modify communications. The exam covers ARP poisoning, DNS spoofing, and SSL/TLS interception techniques. Tools like Ettercap, Bettercap, and SSLstrip are commonly referenced, along with more advanced techniques using tools like MITMf and Responder.

Protocol-Specific Attacks

Understanding attacks against specific network protocols is crucial. This includes SMB relay attacks, LLMNR/NBT-NS poisoning, Kerberoasting against Active Directory environments, and IPv6 attacks in dual-stack networks. The exam expects familiarity with tools like Responder, Impacket, and Rubeus for Windows environment attacks.

Network Service Exploitation

Common network services present various attack vectors. SSH brute-forcing and key-based attacks, FTP bounce attacks, SMTP enumeration and relay attacks, and DNS zone transfer attempts are all covered. Understanding service-specific vulnerabilities and their exploitation methods is essential, as these often appear in performance-based questions.

Wireless Security Exploitation

Wireless attacks have evolved significantly with the adoption of newer security protocols and the proliferation of wireless devices. The PT0-003 exam covers both traditional wireless attacks and modern techniques targeting current wireless implementations.

Wi-Fi Security Attacks

WPA/WPA2 attacks using tools like aircrack-ng, Hashcat, and John the Ripper are fundamental knowledge areas. The exam covers four-way handshake capture and cracking, PMKID attacks against WPA2 networks, and WPS PIN brute-forcing using tools like Reaver and Bully.

WPA3 attacks represent newer content, including downgrade attacks to force WPA2 connections and DragonBlood vulnerabilities in WPA3's SAE (Simultaneous Authentication of Equals) handshake. Understanding the limitations and countermeasures for these attacks is also important.

Enterprise Wireless Attacks

Enterprise environments using 802.1X authentication present unique attack opportunities. EAP-based attacks, certificate validation bypasses, and rogue access point deployments using tools like hostapd-wpe are covered. The exam also addresses attacks against wireless management protocols and enterprise wireless controllers.

Physical Access and Social Engineering

Physical attacks and social engineering represent critical vectors that purely technical defenses cannot address. The exam recognizes this reality by including substantial content on physical security bypass and human-focused attack techniques.

Physical Access Techniques

Lock picking, bump key usage, and electronic access control bypasses are covered, though typically at a conceptual level rather than requiring hands-on lock picking skills. RFID cloning and badge duplication attacks using tools like Proxmark3 and Flipper Zero represent more technical physical attack vectors.

USB-based attacks including BadUSB implementations, HID attacks using tools like Rubber Ducky, and physical implants for persistent access are increasingly relevant. The exam covers both attack implementation and detection methods for these physical compromise techniques.

Social Engineering Attacks

Phishing campaigns using tools like GoPhish and King Phisher are fundamental knowledge areas. The exam covers email spoofing, domain squatting, and credential harvesting techniques. Understanding both the technical implementation and psychological aspects of social engineering is important.

Vishing (voice phishing) and SMS phishing (smishing) attacks are covered, including caller ID spoofing and SIM swapping attacks. The exam also addresses social engineering frameworks like the Social-Engineer Toolkit (SET) and their integration with technical attack vectors.

Application-Level Vulnerabilities

Beyond web applications, the exam covers attacks against various application types including mobile applications, desktop applications, and API endpoints. Understanding application security from an attacker's perspective is crucial for comprehensive penetration testing.

Mobile Application Attacks

Android application attacks include APK reverse engineering, intent-based attacks, and exploitation of insecure data storage. Tools like APKTool, dex2jar, and Frida for dynamic analysis are commonly referenced. iOS application attacks cover jailbreak detection bypasses, keychain exploitation, and URL scheme attacks.

API Security Testing

REST and GraphQL API attacks have gained prominence with the API-driven architecture trend. The exam covers authentication bypass techniques, parameter pollution, rate limiting bypasses, and GraphQL-specific attacks like introspection abuse and query complexity attacks. Tools like Postman, Burp Suite, and specialized API testing tools are relevant.

Cloud Infrastructure Attacks

Cloud attacks represent a significant addition to the PT0-003 exam, reflecting the widespread adoption of cloud infrastructure. Understanding cloud-specific attack vectors and exploitation techniques is essential for modern penetration testers.

Cloud Metadata Attacks

Instance metadata service attacks against AWS, Azure, and Google Cloud Platform are crucial knowledge areas. These attacks often provide access to temporary credentials, instance information, and potential privilege escalation paths. Understanding SSRF exploitation to access metadata endpoints and tools like CloudMapper for cloud enumeration is important.

Container and Orchestration Attacks

Docker container escape techniques, Kubernetes misconfiguration exploitation, and container image analysis are covered. Tools like Docker Bench, kube-hunter, and container scanning solutions represent practical knowledge areas. Understanding privilege escalation through container misconfigurations and orchestration platform vulnerabilities is essential.

Exploitation Frameworks and Tools

Modern penetration testing relies heavily on exploitation frameworks and specialized tools. The exam expects familiarity with both commercial and open-source solutions, their capabilities, and appropriate use cases.

Metasploit Framework

Metasploit remains the most prominent exploitation framework. The exam covers module types (exploits, payloads, encoders, NOPs), msfconsole usage, payload generation with msfvenom, and post-exploitation modules. Understanding Metasploit's architecture and customization capabilities is important for complex scenarios.

Advanced Metasploit topics include custom module development, evasion techniques, and integration with other tools. The exam may include scenarios requiring specific payload configurations or evasion techniques to bypass modern security controls.

Alternative Exploitation Frameworks

Beyond Metasploit, frameworks like Cobalt Strike, Empire, and open-source alternatives like Covenant and Sliver are covered. Understanding the strengths and appropriate use cases for different frameworks is important, as is knowledge of their detection signatures and evasion capabilities.

Framework	Primary Use	Language	Stealth Level
Metasploit	General exploitation	Ruby	Low to Medium
Cobalt Strike	Advanced persistent threats	Java	High
Empire	PowerShell exploitation	PowerShell/Python	Medium to High
Sliver	Cross-platform C2	Go	High

Study Strategies for Domain 4

Given the hands-on nature of attacks and exploits, theoretical study alone is insufficient. Successful candidates combine conceptual understanding with practical experience using the tools and techniques covered in this domain.

Establishing a comprehensive lab environment is crucial for Domain 4 preparation. This should include vulnerable applications like DVWA, WebGoat, and VulnHub VMs for practicing various attack techniques. Cloud labs using AWS, Azure, or Google Cloud free tiers allow practice with cloud-specific attacks covered in the exam.

The relationship between Domain 4 and other exam domains is significant. Domain 3 vulnerability discovery techniques directly feed into Domain 4 exploitation methods, while successful attacks enable Domain 5 post-exploitation activities. Understanding these connections helps with both exam success and real-world application.

Practice Recommendations

Effective preparation for Domain 4 requires hands-on practice with realistic scenarios. Our practice test platform includes performance-based simulations that mirror the actual exam environment, allowing you to practice both the technical skills and time management needed for success.

Focus areas for intensive practice should include web application testing using Burp Suite or OWASP ZAP, network attacks using tools like Nmap, Metasploit, and Wireshark, and wireless security testing with the aircrack-ng suite and related tools. Each area requires both tool proficiency and understanding of when and how to apply specific techniques.

Consider the overall exam challenge level when preparing for Domain 4. As discussed in our analysis of PenTest Plus exam difficulty, the hands-on nature of this domain contributes significantly to the overall exam challenge. Candidates should expect complex scenarios requiring multiple attack techniques and tool combinations.

Understanding the exam's overall structure helps prioritize study efforts effectively. Our complete guide to all PenTest Plus domains provides context for how Domain 4 fits within the broader certification requirements and helps optimize study time allocation across all content areas.

Regular practice testing is essential for Domain 4 mastery. Use our comprehensive practice questions to identify knowledge gaps and track improvement over time. Focus particularly on scenarios combining multiple attack vectors, as these represent the most challenging question types on the actual exam.

The investment in mastering Domain 4 extends beyond exam success. Understanding these attack techniques is fundamental to effective penetration testing careers, directly impacting earning potential as outlined in our PenTest Plus salary analysis. The practical skills developed while studying this domain form the core competencies that employers value in penetration testing professionals.