book

CompTIA PenTest+ Study Guide, 2nd Edition

by Mike Chapple, David Seidl

November 2021

Intermediate to advanced

576 pages

15h 11m

English

Sybex

Read now

Unlock full access

CompTIAThe PenTest+ ExamWhat Does This Book Cover?CompTIA PenTest+ Certification Exam ObjectivesAssessment TestAnswers to Assessment Test
What Is Penetration Testing?Reasons for Penetration TestingWho Performs Penetration Tests?The CompTIA Penetration Testing ProcessThe Cyber Kill ChainTools of the TradeSummaryExam EssentialsLab ExercisesReview Questions
Scoping and Planning EngagementsPenetration Testing Standards and MethodologiesKey Legal Concepts for Penetration TestsRegulatory Compliance ConsiderationsSummaryExam EssentialsLab ExercisesReview Questions

Footprinting and EnumerationActive Reconnaissance and EnumerationInformation Gathering and DefensesSummaryExam EssentialsLab ExercisesReview Questions
Identifying Vulnerability Management RequirementsConfiguring and Executing Vulnerability ScansSoftware Security TestingDeveloping a Remediation WorkflowOvercoming Barriers to Vulnerability ScanningSummaryExam EssentialsLab ExercisesReview Questions
Reviewing and Interpreting Scan ReportsValidating Scan ResultsCommon VulnerabilitiesSummaryExam EssentialsLab ExercisesReview Questions
Exploits and AttacksExploitation ToolkitsExploit SpecificsLeveraging ExploitsPersistence and EvasionPivotingCovering Your TracksSummaryExam EssentialsLab ExercisesReview Questions
Identifying ExploitsConducting Network ExploitsExploiting Windows ServicesIdentifying and Exploiting Common ServicesWireless ExploitsSummaryExam EssentialsLab ExercisesReview Questions
Physical Facility Penetration TestingSocial EngineeringSummaryExam EssentialsLab ExercisesReview Questions
Exploiting Injection VulnerabilitiesExploiting Authentication VulnerabilitiesExploiting Authorization VulnerabilitiesExploiting Web Application VulnerabilitiesUnsecure Coding PracticesSteganographyApplication Testing ToolsSummaryExam EssentialsLab ExercisesReview Questions
Attacking HostsCredential Attacks and Testing ToolsRemote AccessAttacking Virtual Machines and ContainersAttacking Cloud TechnologiesAttacking Mobile DevicesAttacking IoT, ICS, Embedded Systems, and SCADA DevicesAttacking Data StorageSummaryExam EssentialsLab ExercisesReview Questions
The Importance of CommunicationRecommending Mitigation StrategiesWriting a Penetration Testing ReportWrapping Up the EngagementSummaryExam EssentialsLab ExercisesReview Questions
Scripting and Penetration TestingVariables, Arrays, and SubstitutionsComparison OperationsString OperationsFlow ControlInput and Output (I/O)Error HandlingAdvanced Data StructuresReusing CodeThe Role of Coding in Penetration TestingSummaryExam EssentialsLab ExercisesReview Questions
Solution to Activity 5.2: Analyzing a CVSS Vector

Content preview from CompTIA PenTest+ Study Guide, 2nd Edition

Appendix BSolution to Lab Exercise

Solution to Activity 5.2: Analyzing a CVSS Vector

The CVSS vector for the IKE vulnerability shown in Figure 5.22 is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Breaking this down piece by piece gives us the following:

AV:N indicates that an attacker may exploit the vulnerability remotely over a network. This is the most serious value for this metric.
AC:L indicates that exploiting the vulnerability does not require any specialized conditions. This is the most serious value for this metric.
PR:N indicates that attackers do not need any authenticated privileges. This is the most serious value for this metric.
UI:N indicates that no user interaction is necessary to exploit the vulnerability.
S:U indicates ...