Tool up for the CompTIA PenTest+ PT0-003 exam

PenTest+PT0-003CompTIAOffensive SecurityScripting

Nov 26, 2025

Passing the CompTIA PenTest+ (PT0-003) certification requires a solid understanding of over 70 offensive security tools. Understanding why these tools are used, specific tool syntax and typical output can help you prepare and go into the exam with confidence.

In preparing for the exam, the key study resources that stood out for me were:

CompTIA PenTest+ Study Guide: Exam PT0-003 Book by Mike Chapple, David Seidl, and Robert Shimonski: This laid down the theory, objective by objective.
TryHackMe PenTest+ path plus loads of other rooms to target specific tools and attacks.
The Complete Pentest+ Course on Simply Cyber Academy. This is a fairly new release so picked it up late in my studies; Kudos to Daniel Lowrie for making this material so much fun to learn, thank you!
Chris Greer udemy course: Nmap for Ethical Hackers - The Ultimate Hands-On Course. Knowing what happens "on the wire" during host enumeration was really useful for me.
Getting hands-on with Kali Linux made the difference here. Knowing the tools and syntax inside-out was non-negotiable to get a solid pass.

So roll up your sleeves and tool up...I've got your back!

Tools broken down by domain

Domain 2.0 Tools and Examples
- Nmap
- theHarvester
- WHOIS
- nslookup / dig
- Amass (OWASP)
- Shodan
- Wireshark / tcpdump
- Aircrack-ng
- Maltego
- SpiderFoot
- Wayback Machine
- Censys.io
- Hunter.io
- DNSdumpster
- Nmap NSE
- WiGLE.net
- InSSIDer
- OSINTframework.com
- Recon-ng
Domain 3.0 Tools and Examples
- Nikto
- OpenVAS
- Nessus
- TruffleHog
- BloodHound
- PowerSploit
- Grype
- Trivy
- Kube-hunter
Domain 4.0 Tools and Examples
Other tools
- WinPEAS
- LinPEAS / LinEnum
- Tar / Zip
- LOLBins
- pyinstaller
- ps2exe
- sc.exe
- WinRM
- WMI

✅ Domain 2.0 Tools and Examples

1. Nmap

Use Case: Network scanning and service enumeration.

Input Example:

nmap -sV -p 80,443 192.168.1.10

Output Example:

PORT    STATE SERVICE VERSION
80/tcp  open  http    Apache httpd 2.4.41
443/tcp open  https   OpenSSL 1.1.1


| ICMP Code | Meaning                                   | Typical Cause                                         | Nmap Interpretation              |
|-----------|-------------------------------------------|-------------------------------------------------------|----------------------------------|
| 0         | Network Unreachable                       | No route to the network                               | Host/network down or unreachable |
| 1         | Host Unreachable                          | Host not responding, ARP failure, or interface down   | Host down                        |
| 2         | Protocol Unreachable                      | Protocol not supported at destination                 | Protocol not available           |
| 3         | Port Unreachable                          | No service bound to that port (common with UDP)       | Port closed                      |
| 9         | Network Administratively Prohibited       | Firewall/ACL blocking network                         | Filtered                         |
| 10        | Host Administratively Prohibited          | Firewall/ACL blocking host                            | Filtered                         |
| 13        | Communication Administratively Prohibited | Firewall/ACL blocking traffic by policy               | Filtered                         |

Closed → When it gets a clear ICMP Port Unreachable (Code 3).
Filtered → When it gets an ICMP “Administratively Prohibited” (Codes 9, 10, 13) or no response at all.
Open|Filtered → When it can’t tell if the port is open or filtered (e.g., UDP with no response).
Down → When ICMP Host/Network Unreachable (Codes 0, 1) persist.