Free, no-login CompTIA PenTest+ (PT0-003) study console. 91 tools, each mapped to a real PT0-003 exam objective, with a plain-English description and an exam tip. This page also includes an interactive match-drill quiz and a bonus Bash/PowerShell/Python syntax-difference game — JavaScript required for those; the reference table below works without it.
| Tool | Category | Objective(s) | OS | Description | Exam tip |
|---|---|---|---|---|---|
| Wayback Machine | Reconnaissance & Enumeration | 2.4 | * | Retrieve archived versions of websites to find old endpoints, exposed credentials, or removed pages. | Passive recon; no traffic sent to the live target. |
| Maltego | Reconnaissance & Enumeration | 2.4,4.8 | * | GUI OSINT tool that maps relationships between domains, people, orgs, and IPs using data-source "transforms", visualized as a graph. | Think social-graph / infrastructure correlation; also listed under social engineering (4.8) for target profiling. |
| Recon-ng | Reconnaissance & Enumeration | 2.4,4.8 | L, M | Modular, automated framework -- organized into workspaces, modules, and API keys -- for gathering domains, contacts, and subdomains from public sources. | Framework/module structure mirrors Metasploit; also listed under social engineering (4.8). Default modules are passive API/OSINT lookups — a handful (DNS brute-force, host resolution) actively touch the target. |
| Shodan | Reconnaissance & Enumeration | 2.4 | * | Search engine for internet-connected devices and exposed services (IoT, default creds, open ports) without touching the target. | Passive — you're querying Shodan's index, not the target. |
| SpiderFoot | Reconnaissance & Enumeration | 2.4 | * | Automated OSINT web-UI tool covering domains, IPs, email leaks, and dark-web mentions; good for broad attack-surface mapping. | Web UI + broad automated OSINT is the SpiderFoot signature — contrast with theHarvester (CLI) and Maltego (GUI graph). Ships Passive/Footprint/Investigate/All scan modes — only Passive mode is fully hands-off the target. |
| WHOIS | Reconnaissance & Enumeration | 2.4 | * | Query domain registrant info, registration dates, name servers, and contact data. | Usually the first passive-recon step; reveals ownership/infrastructure. |
| nslookup / dig | Reconnaissance & Enumeration | 2.4 | * | Query DNS servers directly for A, MX, NS, TXT, CNAME, and PTR records. | Active — queries go to real DNS servers and may be logged; nslookup is W/L/M, dig is L/M. |
| Censys.io | Reconnaissance & Enumeration | 2.4 | * | Search internet-wide scan data for certificates, open ports, and services. | Similar to Shodan; distinguishing strength is certificate/TLS analysis. |
| Hunter.io | Reconnaissance & Enumeration | 2.4 | * | Find and verify email addresses associated with a domain. | Prep step for social engineering/phishing. |
| DNSdumpster | Reconnaissance & Enumeration | 2.4 | * | Subdomain and DNS record mapping tool that builds a visual attack-surface map. | Quick attack-surface overview before deeper enumeration. Hosted service querying its own collected data and public DNS sources — markets itself as passive recon, does not port-scan the target. |
| Amass | Reconnaissance & Enumeration | 2.4 | L, M, W | Subdomain enumeration combining passive OSINT sources and active DNS techniques. | Preferred over manual DNS lookups for large scopes; comprehensive. |
| Nmap + NSE | Reconnaissance & Enumeration | 2.4,4.2 | * | Port scanning, service/version detection, OS fingerprinting, and scripted enumeration via a built-in scripting engine. | Know scan types (-sS/-sT/-sU/-sN/-sF/-sX/-sA), timing templates (-T0..T5), and NSE categories (default/discovery/auth/vuln) individually and combined. Nmap is NOT in CompTIA's 3.1 vulnerability-discovery tool list despite NSE's --script=vuln category — for vuln-discovery-objective questions, the expected answers are Nessus/OpenVAS/Nikto. |
| theHarvester | Reconnaissance & Enumeration | 2.4,4.8 | L, M | Command-line tool that collects emails, usernames, subdomains, and hostnames from search engines and public sources. | CLI + email harvesting = theHarvester; web UI + broad OSINT = SpiderFoot. Also listed under social engineering (4.8). |
| WiGLE.net | Wireless & RF | 2.4,4.7 | * | Crowdsourced global database of WiFi networks; locate SSIDs by geography. | Passive wireless recon — no active scanning of the air. |
| InSSIDer | Wireless & RF | 2.4,4.7 | W, M | WiFi survey tool that detects nearby SSIDs, channels, signal strength, and security types. | Active wireless enumeration — the adapter transmits probe requests during scanning; contrast with WiGLE (passive crowd-sourced DB) and Kismet (passive monitor-mode sniffing, no transmission). |
| OSINTframework.com | Reconnaissance & Enumeration | 2.4 | * | Directory/reference site of OSINT tools and techniques organized by category. | It's a resource index, not something you "run" against a target. |
| Wireshark / tcpdump | Packet Capture, Crafting & Replay | 2.4,4.2,4.9 | * | Capture and analyze network traffic; protocol analysis and credential sniffing on unencrypted traffic. | Both appear on the exam — used across recon, network attacks, and specialized systems (4.9). Wireshark is truly cross-platform; tcpdump has no supported native Windows build (WinDump is abandoned) — Windows users get Wireshark/dumpcap instead. For 4.9 questions specifically: that objective is "Explain", not "Given a scenario" like the rest of Domain 4, so expect recognition-level questions there. Wireshark/tcpdump is also tagged 2.4 and 4.2, both "Given a scenario" objectives — filter syntax and scan-type questions are fair game under those. |
| Aircrack-ng | Wireless & RF | 2.4,4.7 | L, W, M | Suite for capturing WPA handshakes, cracking WEP/WPA passwords, and WiFi packet injection. | Know the full workflow: monitor mode → capture → deauth → crack (airmon-ng → airodump-ng → aireplay-ng → aircrack-ng). Officially builds for Linux, Windows, macOS, and BSD, though monitor-mode/injection driver support is weakest on Windows. |
| Nikto | Vulnerability & Configuration Scanning | 3.1 | L, M | Web server vulnerability and misconfiguration scanner; noisy, detected by IDS/WAF. | Good for default files, misconfigs, outdated software; expect detection. CompTIA lists Nikto under 3.1 vulnerability discovery, NOT under 4.5's web-app tool list — 4.5's scanning-flavored tools are TruffleHog, Burp, ZAP, and WPScan. |
| OpenVAS / Greenbone | Vulnerability & Configuration Scanning | 3.1 | L | Open-source vulnerability scanner; identifies CVEs across network hosts via a web UI. | The current product is Greenbone Community Edition (GVM); "OpenVAS" now names the scanner component within it. CompTIA prints both names together — treat them as the same answer. |
| TruffleHog | Vulnerability & Configuration Scanning | 3.1,4.5 | L, M, W | Finds secrets (API keys, passwords, tokens) in Git repositories and source code. | Appears in both vulnerability discovery (3.1) and web app attacks (4.5). Scanning is passive, but its signature feature — live credential verification against the provider's API — makes outbound authenticated calls and can trip alerting; know verified vs. unverified mode. |
| BloodHound | Windows/AD Enumeration & Attack-Path Mapping | 3.1,4.3 | * | Maps Active Directory attack paths built from ACLs/ACEs, group memberships, sessions, and GPO links (trust relationships are only one edge type among many) to identify escalation paths to Domain Admin, using data from a separate collector tool visualized as a graph. | Critical for AD environments; pairs with SharpHound for data collection (also listed under authentication attacks, 4.3). SharpHound is the collector — PowerView is a separate, standalone enumeration tool, not a BloodHound ingestor. |
| Tenable Nessus | Vulnerability & Configuration Scanning | 3.1 | * | Industry-standard vulnerability scanner; prioritizes findings by CVSS, supports authenticated and unauthenticated scans. | Nessus Essentials is the free version; know authenticated vs. unauthenticated differences. |
| PowerSploit | Native Scripting & Living-off-the-Land Automation | 3.1,4.10 | W | PowerShell exploitation and post-exploitation module collection (privilege escalation, persistence, recon). | Living-off-the-land style attacks on Windows; also grouped under scripting/automation (4.10). |
| Grype | Vulnerability & Configuration Scanning | 3.1 | L, M, W | Container and filesystem vulnerability scanner; finds CVEs in container images. | Narrower scope than Trivy — container-focused only, no IaC scanning. |
| Trivy | Vulnerability & Configuration Scanning | 3.1 | L, M, W | Scans containers, Infrastructure-as-Code, and dependencies for CVEs and misconfigurations. | Broader than Grype — if the question mentions IaC or dependency scanning, it's Trivy. |
| Kube-hunter | Cloud & Container Platform Attack/Audit | 3.1,4.6 | L, M | Probes Kubernetes clusters for security weaknesses, from outside or from within a pod. | Appears in both vuln discovery (3.1) and cloud attacks (4.6). Aqua Security's own README now states kube-hunter is no longer under active development and recommends Trivy for Kubernetes vulnerability scanning. |
| Metasploit | Exploitation Frameworks & Payload Generation | 4.2,5.2 | L, W, M | Exploitation framework with thousands of modules for exploits, payloads, and post-exploitation. | Know module types: exploit, payload, auxiliary, post, encoder, nop, evasion. Also listed under lateral movement (5.2). |
| Netcat | Lateral Movement, Remote Execution & Pivoting | 4.2,5.2 | L, W, M | "Swiss army knife" of networking — reverse/bind shells, port listening, file transfer, tunneling. | Essential for shells and pivoting; also listed under lateral movement (5.2). |
| Impacket | Lateral Movement, Remote Execution & Pivoting | 4.2,4.10,5.2 | L, M, W | Python library and script collection for exploiting SMB/Kerberos/LDAP — relay attacks, remote execution, ticket manipulation, hash dumping. | Critical Windows/AD toolkit; also listed under scripting (4.10, as the Python entry) and lateral movement (5.2). Distinguishing shape vs. CrackMapExec: Impacket is a library/collection of single-purpose scripts you run one at a time (psexec.py, secretsdump.py, ...); CrackMapExec is a single tool that sweeps and attacks many hosts at once. |
| CrackMapExec (CME) | Lateral Movement, Remote Execution & Pivoting | 4.2,4.3,5.2 | L, M | Automates SMB/AD enumeration and attacks — credential spraying, share enumeration, remote command execution, lateral movement. | One-stop AD attack tool spanning network attacks (4.2), authentication attacks (4.3), and lateral movement (5.2). Note: upstream CrackMapExec is unmaintained since 2023 and superseded by the NetExec (nxc) fork — CompTIA still names "CrackMapExec (CME)", so know both names. Distinguishing shape vs. Impacket: CME is a single automated many-hosts-at-once sweeper/attack tool; Impacket is the underlying library/script collection CME (and many other tools) is built on. |
| msfvenom | Exploitation Frameworks & Payload Generation | 4.2 | L, W, M | Generates standalone payloads (reverse shells, shellcode) for delivery to a target. | Pairs with Metasploit's exploit/multi/handler as the catching listener. |
| Responder | Windows/AD Credential Theft & Network Poisoning | 4.2,4.3 | L | Poisons LLMNR/NBT-NS/MDNS name-resolution broadcasts and stands up rogue HTTP/SMB/MSSQL/LDAP authentication servers to capture NetNTLMv1/NetNTLMv2 hashes when Windows clients fail DNS lookups. | Responder captures; hashcat/John crack offline. Know the full chain. Also listed under authentication attacks (4.3). Captures NetNTLMv1 as well as NetNTLMv2, and stands up rogue HTTP/SMB/MSSQL/LDAP auth servers, not just name-resolution poisoning. |
| Hydra | Credential Guessing & Offline Cracking | 4.2,4.3 | L, M | Protocol-aware brute-force tool for credentials across many services (SSH, FTP, HTTP, RDP, SMB). | Different command syntax per protocol; also listed under authentication attacks (4.3). Distinguishing detail vs. Medusa: functionally near-identical goal; Hydra is more commonly referenced on the exam and has broader protocol/module support in practice. |
| Mimikatz | Windows/AD Credential Theft & Network Poisoning | 4.4,5.2 | W | Extracts plaintext passwords, NTLM hashes, and Kerberos tickets from Windows memory (LSASS); also performs DCSync and golden-ticket attacks. | Most important credential-dumping tool on the exam; also listed under lateral movement (5.2). |
| Rubeus | Windows/AD Credential Theft & Network Poisoning | 4.4 | W | Pure .NET Kerberos attack toolkit — ticket requesting, forging, pass-the-ticket, Kerberoasting, AS-REP roasting. | Complement to Mimikatz for ticket-based attacks specifically. |
| Certify | Windows/AD Credential Theft & Network Poisoning | 4.4 | W | Enumerates and abuses Active Directory Certificate Services (AD CS) misconfigurations. | AD CS abuse (ESC1-ESC8, and later additions to that taxonomy) is a growing exam topic; pairs with Rubeus. |
| Seatbelt | Windows/AD Enumeration & Attack-Path Mapping | 4.4 | W | Enumerates Windows security posture — installed defenses, configs, and credential artifacts. | Know what it looks for: security tools present, credential artifacts. |
| PowerShell / PowerShell ISE | Native Scripting & Living-off-the-Land Automation | 4.4,5.2,4.10 | W | Native Windows scripting shell and its Integrated Scripting Environment; used to run/write attack scripts directly on Windows hosts. | Listed as its own tool separate from PowerSploit/PowerView — the shell itself, not a module set. Cross-listed under 4.4 (host-based attacks), 4.10 (scripting — "PowerShell" headings 4.10's first sub-bullet group), and 5.2 (lateral movement, as "PowerShell ISE"). |
| PsExec | Lateral Movement, Remote Execution & Pivoting | 4.4,5.2 | W | Remote command execution on Windows using valid credentials over SMB; creates a (noisy) service on the target. A Linux-native reimplementation of the same technique exists as well. | Requires valid creds and SMB access; also listed under lateral movement (5.2). |
| Evil-WinRM | Lateral Movement, Remote Execution & Pivoting | 4.4 | L, M | Remote shell that rides Windows' native remote-management protocol (TCP 5985/5986); supports upload/download and pass-the-hash. | Good alternative to PsExec when WinRM is enabled; supports PTH. |
| LOLBins | Native Scripting & Living-off-the-Land Automation | 4.4,5.2 | W | Abuse built-in or Microsoft-signed Windows binaries (netstat, net commands, cmd.exe, explorer.exe, ftp.exe, mmc.exe, rundll32, msbuild, route, strings/findstr.exe, and more) for stealth — no dropped tools, blends with normal activity. | CompTIA names a specific sub-list under 5.2 (netstat, net commands, cmd.exe, explorer.exe, ftp.exe, mmc.exe, rundll32, msbuild, route, strings/findstr.exe) — a different sub-list than commonly-cited examples like certutil/regsvr32/wmic. Know the 5.2 list by name. Also listed under host-based attacks (4.4). Rule of thumb vs. Batch files/PowerShell ISE: a single abused native binary → LOLBins; a chained sequence of commands saved to a script file → Batch files or PowerShell (ISE). |
| Burp Suite | Web Application Testing & Exploitation | 4.3,4.5 | * | Web app testing proxy -- intercept/modify requests, an automated scanner, a built-in fuzzer for parameter attacks, and a request-replay feature for hands-on manual testing. | Primary web app testing tool; also listed under authentication attacks (4.3). Community Edition is free (no active scanner, throttled Intruder) — Pro/Enterprise are the paid tiers. |
| OWASP ZAP | Web Application Testing & Exploitation | 4.5 | * | Open-source web proxy/scanner for automated and manual web app testing. | Good for DAST scanning. |
| Postman | Web Application Testing & Exploitation | 4.5 | * | API client for building, sending, and automating HTTP requests — used to manually probe and script tests against REST/GraphQL APIs. | Distinguishing angle vs. Burp/ZAP: API collections/environments/scripted requests, not proxy-and-scan of a full app. |
| sqlmap | Web Application Testing & Exploitation | 4.5 | L, M, W | Automated SQL injection detection and exploitation, including database/table enumeration and data dumping. | Know how to point it at a vulnerable parameter, or feed it a captured request file (-r). |
| Gobuster / DirBuster | Web Application Testing & Exploitation | 4.5 | L, M, W | Brute-forces web directories, files, subdomains, and virtual hosts. | Gobuster: know dir vs. dns vs. vhost modes (plus fuzz/s3/gcs/tftp). DirBuster is a separate, long-unmaintained Java GUI tool with no dns/vhost modes — the mode-switching description applies to Gobuster specifically. |
| Wfuzz | Web Application Testing & Exploitation | 4.5 | L, M, W | Web parameter fuzzer — finds hidden parameters and brute-forces inputs using a FUZZ injection-point marker. | FUZZ can mark the injection point anywhere in the request — path, parameters, headers, cookies, or body — not just parameters; that flexibility is the real contrast with Gobuster's path-only brute-forcing. Wfuzz is effectively unmaintained. |
| WPScan | Web Application Testing & Exploitation | 4.5 | L, M | WordPress-specific vulnerability scanner — enumerates users, plugins, themes, and known CVEs. | If the target is WordPress, this is the go-to tool. |
| hashcat | Credential Guessing & Offline Cracking | 4.3 | W, L, M | GPU-accelerated offline password/hash cracking, supporting mask and hybrid attacks across many hash types. | Faster than John for large hash sets; know common hash modes (0=MD5, 1000=NTLM, 5600=NetNTLMv2, 13100=Kerberos 5 TGS-REP etype23). Listed under authentication attacks, objective 4.3. |
| John the Ripper | Credential Guessing & Offline Cracking | 4.3 | L, M, W | Password-cracking tool with automatic hash-type detection; historically framed as the CPU-based option, in contrast to a GPU-accelerated one. | CPU vs. GPU is the key John-vs-hashcat distinction at the exam level; John auto-detects format. (In reality, John the Ripper "jumbo" edition adds OpenCL/CUDA GPU support for many formats — the CPU/GPU split is the CompTIA-level answer, not a hard technical limit.) |
| Medusa | Credential Guessing & Offline Cracking | 4.3 | L, M | Parallel, modular brute-force tool across many protocols. | Similar to Hydra; parallel/modular architecture; less commonly tested but listed under authentication attacks, objective 4.3. Builds on Linux, BSD, and macOS (via Homebrew). Distinguishing detail vs. Hydra: same goal (protocol brute-force), implemented with a parallel/modular architecture — the two are largely interchangeable for exam purposes. |
| Pacu | Cloud & Container Platform Attack/Audit | 4.6 | L, M | AWS exploitation framework — enumerates and actively attacks AWS misconfigurations (IAM, S3, EC2, etc.). | AWS-specific and offensive — pairs with Prowler/ScoutSuite for full cloud assessments. |
| Prowler | Cloud & Container Platform Attack/Audit | 4.6 | L, M | AWS-focused security auditing/compliance scanner, and the tool most associated with the CIS AWS Foundations Benchmark and CIS AWS partnership. Runs compliance checks (CIS, NIST, PCI-DSS, HIPAA, SOC2, and more) against a live AWS tenant's IAM, logging, and encryption configuration. Version 3+ (2022 onward) added Azure/GCP/Kubernetes/M365/GitHub support, but AWS remains its core identity and the likely exam-level distinction from the multi-cloud alternative in this database. | At the exam level, treat this as the AWS-specific compliance/audit tool -- its long-standing identity as the CIS AWS Foundations Benchmark tool -- versus ScoutSuite as the multi-cloud one (AWS/Azure/GCP since ScoutSuite's inception). That's the cleanest discriminator between the two, even though real-world Prowler v3+ also added multi-cloud support. Authenticates to the live AWS tenant via the provider API -- every call lands in CloudTrail -- so it is ACTIVE, not passive (4.6's own "Logging information exposure" bullet connects to this). |
| ScoutSuite | Cloud & Container Platform Attack/Audit | 4.6 | L, M | Multi-cloud security auditing tool (stable support for AWS, Azure, and GCP; alpha support for several other providers) that runs read-only checks against a cloud account and generates a browsable HTML report of misconfigurations. | Distinguishing feature is the generated HTML misconfiguration report, not exclusive multi-cloud coverage — Prowler is multi-cloud too as of v3+. Stable support: AWS, Azure, GCP; alpha support for Alibaba Cloud, OCI, DigitalOcean, and Kubernetes-on-cloud. |
| Docker Bench for Security | Cloud & Container Platform Attack/Audit | 4.6 | L | Audits a container host and its running workloads against the CIS benchmark for that platform -- host configuration, daemon configuration and config files, image/build files, container runtime, security operations, and Swarm configuration. | Like Prowler but for Docker/container hardening instead of cloud-provider misconfig. Checks span host config, daemon config and config files, container images/build files, container runtime, Docker security operations, and Swarm config. |
| WiFi-Pumpkin | Wireless & RF | 4.7 | L | Rogue access point framework for evil-twin attacks and MITM interception of WiFi clients. | Captures credentials/traffic from victims connecting to the fake AP. |
| Kismet | Wireless & RF | 4.7 | L, M | Wireless network detector, sniffer, and intrusion-detection tool for passive WiFi mapping, including hidden SSIDs. | Detects hidden SSIDs without transmitting. |
| SET (Social Engineering Toolkit) | Social Engineering & Phishing | 4.8 | L, M | Menu-driven framework to automate phishing, credential harvesting, and payload-delivery attacks aimed at people rather than systems. | Primary social engineering framework on the exam. Officially supports Linux and macOS; Windows support is unofficial/partial. |
| Gophish | Social Engineering & Phishing | 4.8 | * | Manages and tracks phishing campaigns — landing pages, email templates, click tracking. | Tracks who clicked/submitted credentials — the reporting/management layer. |
| Evilginx | Social Engineering & Phishing | 4.8 | L | Reverse-proxy phishing tool that captures credentials AND session tokens/cookies, bypassing MFA. | Key tool for MFA bypass — more advanced than standard credential phishing. |
| BeEF | Social Engineering & Phishing | 4.8 | L, M | Hooks a victim's web browser through an injected script — typically delivered via an XSS finding — and turns it into a persistent command-and-control channel for client-side attacks and internal network pivoting. | Client-side exploitation — hooks victims' browsers for further attacks. |
| Scapy | Packet Capture, Crafting & Replay | 4.9,4.10 | L, M | Python packet-manipulation library/tool — craft, send, receive, and analyze packets at any network layer; interactive shell plus scripting. | Listed under specialized-systems attacks (4.9) and as one of two named Python tools under scripting (4.10) — it is NOT in CompTIA's 2.4 recon tool list, unlike Wireshark/tcpdump. Know it as both a tool and a library (interactive shell plus importable in scripts). For 4.9 questions specifically: that objective is "Explain", not "Given a scenario" like the rest of Domain 4, so expect recognition-level questions there. Scapy is also tagged 4.10 ("Given a scenario, use scripting..."), so scripting-level questions are fair game under that objective even though 4.9 questions about it stay at the recognition level. |
| tcpreplay | Packet Capture, Crafting & Replay | 4.9 | L, M | Replays previously captured pcap traffic back onto a live interface at controllable speed — tests IDS/IPS/monitoring response or resends OT/ICS protocol captures. | CompTIA's objectives PDF literally prints "tcprelay" under 4.9 (verified against CompTIA's own hosted copy, not a render artifact). Most likely a CompTIA typo for tcpreplay — supported by 4.9's own OT attack-type bullets ("Replay attack") and its grouping with Scapy/Wireshark-tcpdump. But at least one independent PT0-003 prep source (StationX) instead reads "tcprelay" as the iOS usbmuxd SSH-over-USB relay utility (tcprelay.py), which fits the mobile-heavy company it also keeps (MobSF, Frida, Drozer, ADB). Know both readings; distinct from tcpdump (captures) and Scapy (crafts/sends custom packets). 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| MobSF | Mobile & Specialized-System Testing | 4.9 | * | Mobile app static and dynamic analysis platform for Android and iOS. | Provides both static analysis (no app execution) and a dynamic analyzer that runs the app in an instrumented Android VM/emulator and captures live traffic — contrast with Frida, which is runtime-only. 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| Frida | Mobile & Specialized-System Testing | 4.9 | * | Dynamic instrumentation toolkit that hooks into running mobile apps to inspect/modify behavior at runtime. | Used to bypass SSL pinning and inspect function calls live. 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| Drozer | Mobile & Specialized-System Testing | 4.9 | L, M | Android app and OS exploitation framework — exploits IPC, content providers, and exported activities. | Android-only exploitation framework. 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| ADB (Android Debug Bridge) | Mobile & Specialized-System Testing | 4.9 | * | Command-line bridge for controlling an Android device directly -- shell access, file transfer, app install/uninstall. | Requires USB debugging enabled or network ADB. 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| Bluestrike | Wireless & RF | 4.9 | L | Early-stage open-source CLI tool for Bluetooth attacks; currently implements Bluetooth speaker jamming, with device hijacking and traffic spoofing stated as project goals rather than working features as of this writing. | Listed under 4.9 alongside Bluejacking/Bluetooth-spamming attack types — likely tested as "a Bluetooth attack tool" rather than on command specifics. 4.9 is an "Explain" objective, not "Given a scenario" like the rest of Domain 4 — expect recognition-level questions (what this tool is for), not command syntax. |
| PowerView | Windows/AD Enumeration & Attack-Path Mapping | 4.10 | W | PowerShell-based Active Directory enumeration — users, groups, computers, trusts, ACLs, logged-on sessions — to build an AD attack-path picture. | SharpHound collects data for BloodHound; PowerView is a separate, standalone PowerShell AD enumeration tool — same general goal (map AD), no shared pipeline. Historically shipped as part of PowerSploit's Recon module — the two are related, not independent peers, though PowerView is commonly used and updated as a standalone tool today. |
| PowerUpSQL | Native Scripting & Living-off-the-Land Automation | 4.10 | W | PowerShell toolkit for discovering and attacking Microsoft SQL Server — instance discovery, privilege escalation, linked-server crawling. | "PowerShell + MSSQL" is the distinguishing pair vs. sqlmap's general web-app SQL injection. |
| MITRE Caldera | Breach & Attack Simulation (BAS) | 4.10 | L, M, W | Breach-and-attack-simulation platform that runs scripted, ATT&CK-mapped "abilities" against targets via agents to test detection/response. | Tests whether defenses catch known ATT&CK techniques — distinct from a manual exploitation tool. |
| Infection Monkey | Breach & Attack Simulation (BAS) | 4.10 | L, W | Open-source BAS tool that safely self-propagates across a network like a worm to map attack paths and find exploitable misconfigurations. | Focused on lateral-movement/propagation testing across a network, vs. Caldera's broader technique emulation. Supported platforms: Linux and Windows (server and agents) — macOS is not supported. |
| Atomic Red Team | Breach & Attack Simulation (BAS) | 4.10 | L, M, W | Library of small, discrete test scripts ("atomics"), each mapped to one MITRE ATT&CK technique, run individually to validate detection. | Contrast with Caldera (multi-step chains) and Infection Monkey (network propagation). |
| Covenant | C2 Frameworks | 5.2 | L, M, W | .NET C2 framework for managing agents, persistence, and lateral movement in post-exploitation. | Know the general concept of C2 beacon/listener architecture. cobbr/Covenant has seen no active development since ~2023 — still exam-listed, but note it when picking a lab C2 to practice with. |
| sshuttle | Lateral Movement, Remote Execution & Pivoting | 5.2 | L, M | Creates a VPN-like tunnel through SSH for pivoting, transparently routing traffic through a compromised host. | Easier than Proxychains when you need full-subnet routing. |
| Proxychains | Lateral Movement, Remote Execution & Pivoting | 5.2 | L, M | Routes a specific tool's traffic through SOCKS proxy chains for pivoting and anonymization. | Pairs with SSH tunnels or Metasploit's route command. proxychains-ng also builds and is commonly used on macOS. |
| Empire | C2 Frameworks | — | L, M | Post-exploitation/adversary-emulation C2 framework (BC-SECURITY fork of an earlier PowerShell-only project) -- Python 3 server with PowerShell, Python, C#/.NET (Sharpire), and IronPython agents, plus a Starkiller GUI client. | Not on official PT0-003 objectives but common in real engagements. BC-SECURITY's Empire 4/5 is a Python 3 C2 server with PowerShell, Python, C#/.NET (Sharpire), and IronPython agents plus a Starkiller GUI — the original "PowerShell-only" Empire is its ancestor, not its current form. |
| Sliver | C2 Frameworks | — | L, M, W | Modern open-source red-team C2 framework, increasingly replacing Cobalt Strike in engagements. | Not yet on PT0-003 objectives; know it exists as a Covenant/Cobalt Strike peer. |
| Ettercap | Windows/AD Credential Theft & Network Poisoning | — | L, M | LAN MITM attack tool — ARP poisoning and traffic interception. | Largely superseded by Responder + Impacket for modern Windows attacks. |
| Cain & Abel | Credential Guessing & Offline Cracking | — | W | Legacy Windows tool for password recovery, sniffing, and hash cracking. | Largely superseded by Mimikatz + hashcat; rarely seen today. |
| Hping3 | Packet Capture, Crafting & Replay | — | L, M | Packet crafting tool for port scanning, DoS testing, and firewall testing. | Packet crafting is a named attack type under both network attacks (4.2) and wireless attacks (4.7) — hping3 is worth knowing for that even though CompTIA doesn't name it directly. Scapy is more flexible/scriptable for exam purposes. |
| Exploit-DB / searchsploit | Exploitation Frameworks & Payload Generation | — | L, M | Command-line search interface to a locally-cloned offline copy of a public exploit archive. | Extremely useful practically even though not explicitly exam-listed. |
| Airgeddon | Wireless & RF | — | L | All-in-one bash wireless auditing suite wrapping several well-known cracking and jamming utilities into one menu -- WEP/WPA/WPA2/WPA3, WPS/Pixie Dust, PMKID, evil twin, and DoS attacks. (A dedicated attack-and-crack orchestrator, not a passive scanner, despite some secondhand descriptions conflating the two.) | All-in-one bash wireless auditing suite wrapping the Aircrack-ng suite plus mdk4, hashcat, bettercap, reaver/bully and others for WEP/WPA/WPA2/WPA3, WPS/Pixie Dust, PMKID, evil twin, and DoS attacks. Actively maintained (v11.x) — not a legacy tool. Not exam-listed but common in wireless engagements. |
| WPAD (Web Proxy Auto-Discovery) | Windows/AD Credential Theft & Network Poisoning | 4.7 | W | Not a tool but a protocol CompTIA lists under 4.7's wireless-attack tools -- Windows hosts auto-discover a proxy via this mechanism, and an attacker on the network (via a name-poisoning tool or a rogue AP) can answer that lookup to relay/capture credentials, similar in mechanism to LLMNR/NBT-NS poisoning. | Odd inclusion under 4.7 (it's not wireless-specific), but CompTIA lists it as the first 4.7 tool bullet — expect it tested as a concept/target rather than a command. |
| Cloud-native vendor tools | Cloud & Container Platform Attack/Audit | 4.6 | * | CompTIA's catch-all for a cloud provider's own built-in security/audit tooling — e.g. AWS CloudTrail, AWS Config, IAM Access Analyzer; Azure Security Center/Defender for Cloud; GCP Security Command Center — used to review logging, config drift, and IAM findings from inside the provider's own console/CLI. | Generic bullet, not a single named product — if a question describes using a cloud provider's own built-in console/service to review its own config, this is the answer category. Same active-vs-passive logic as Prowler/ScoutSuite/Docker Bench: using the provider's own console/CLI against the live tenant still touches the target and is logged there. |
| Batch files | Native Scripting & Living-off-the-Land Automation | 5.2 | W | Windows .bat/.cmd scripts used to automate a sequence of native commands for persistence, execution, or lateral movement without dropping a compiled binary. | Listed alongside PowerShell ISE and LOLBins under 5.2 — think of it as the automation layer that chains native commands together. Rule of thumb vs. LOLBins alone: LOLBins is one abused binary; Batch files is the scripting layer that chains several LOLBins/native commands together into a saved, reusable sequence. |
| AD Search (technique) | Windows/AD Enumeration & Attack-Path Mapping | 4.10 | W | CompTIA's fourth named item under 4.10's PowerShell sub-bullet, alongside PowerSploit/PowerView/PowerUpSQL. Two defensible readings: (1) the generic technique of querying AD directly via PowerShell's native AD cmdlets or raw LDAP, with no dedicated third-party tool; (2) the named C#/.NET tool ADSearch (tomcarver16, distributed via Flangvik's SharpCollection) for querying AD over LDAP — its PDF siblings (PowerSploit/PowerView/PowerUpSQL) are all named tools, which favors this reading structurally even though ADSearch isn't PowerShell. | Listed as its own 4.10 bullet. Ordering rule vs. PowerView (same class, same general AD-enumeration action): if the scenario names a specific toolkit → PowerView; if it just describes querying AD via PowerShell/LDAP with no named tool → AD search. |
| Bash (scripting) | Native Scripting & Living-off-the-Land Automation | 4.10 | L, M | CompTIA's 4.10 top-level bullet for automating attacks via Bash — input/output redirection/piping and text/data manipulation (grep, awk, sed, cut) to chain CLI tools and process their output. | One of 4.10's three named languages (PowerShell, Bash, Python) — expect scenario-level questions about which scripting approach fits a workflow — 4.10 is a "Given a scenario" objective (unlike 4.9's "Explain"), so it IS testable at the how-would-you-automate-this level. CompTIA names only input/output management and data manipulation as Bash sub-topics, so syntax depth stays bounded. |
| Python (scripting) | Native Scripting & Living-off-the-Land Automation | 4.10 | * | CompTIA's 4.10 top-level bullet for automating attacks via Python — the language umbrella under which Impacket and Scapy (both separately entered in this database) are named as the specific examples. | If a question asks generically "which language" rather than naming Impacket/Scapy specifically, this is the umbrella answer. |
| SharpHound | Windows/AD Enumeration & Attack-Path Mapping | — | W | The data-collector companion to a separate graph-visualization tool -- run on a domain-joined Windows host (or via a compromised session) to gather AD session, group-membership, ACL, and trust data, which is then imported into that graphing tool for analysis and querying. | Not separately named in CompTIA's objectives (BloodHound is the named 3.1/4.3 tool), but essential to know: SharpHound collects, BloodHound visualizes. PowerView is a separate, unrelated PowerShell enumeration tool that does NOT feed BloodHound — a common point of confusion between the two. |
.--""--. / \ | R.I.P. | | | | + | |__________| ''''''''''''''